Your assertion that the weakness is in the implementation, and not the certificates themselves. This is indeed correct, I think you should shift the blame away from the PKI vendors and toward the corporate clients.

Blaming Verisign for a corporation's unencrypted database is absurd at best. The role of the certificate is to encrypt data between the client and the host server, and after that point, the PKI vender is no longer culpable.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/60/10528#10528