Who needs a magnetic strip reader? They already have your number and expiration date--on paper and with a signature--and can instantly send it out to hundreds and thousands of people that have intentions of using it illegally if they want to. PKI is no panacea and never will be. But equating ssl with PKI is assanine, quite frankly. PKI can do a bit more than burn ssl certs. It be used to encrypt data in storage, or in transit, and on the backend, to encrypt files, directories, email, used in building acess, hard drive encryption, ATM networks, etc. And developments like OSPF, authentication cookies, HSMs, profiles servers, tokens, challenge-response devices, etc., are all elements to make PKI more secure and robust. There is a lot of unecessary hype behind PKI, yes, but it's the best we have and a very effective tool to use in a larger security process.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/60/10581#10581