I only refer to Bruce Schneiers "Secret and Lies". There Bruce said security is a process and not a product. How true how true......

Any encryption no matter if weak or strong is useless if the backend stores the data plain text. I am not concerned about the data transmission itself.... it is the storage and the handling of data that needs to be secured. How easy it is to intercept SSL traffic shows ettercap, a nice Man in the middle attack. Also people aren't carefull enough. If this nice window with the certificat information pops up and asks if you want to accept the cert people just click yes. Only a few people actually verify the certificate.



[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/60/10744#10744