This is ridiculous and irresponsible. Should I even bother pointing out that Entrust's flagship product, TruePass, was specifically designed and marketed as, among other things, a technology to overcome the lack of persistent encryption in SSL? I think the company is quite honest in pointing out this flaw. It helps them sell their product. Why say they have something to hide or are less than honest with their customers?

As far as trusting people to operate a secure system, what is your point? Would you prefer that people not trust people hired to perform in trusted roles with a set of responsibilities and stated liabilities? Why trust the President to run the country? Why trust the person at McDonalds to not poison your burger? If we can't rely on policies and procedures to describe how people are to operate a system, and expect people to follow them, why bother having any business or government of any kind? This is a ridiculous debating point with no useful outcome.

Also, why are you being deceptive in not pointing out that most credit cards offer fraud protection? Perhaps you have something to hide?

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/60/10677#10677