So if we dont have the quality of data to use an objectivist approach to probability, that leaves two alternatives:
Donn Parkers no risk approach – where we dont acknowledge probability, frequency, or risk at all, or
A …

SSL, as it is implemented on the web, is next to useless.

Don’t throw the baby out with the bathwater, though. SSL, as implemented on corporate wireless networks via EAP-TLS, is good security, authenticating both endpoints to each other as well as users.

And I don’t know how “stuck” we are for those connections where we can influence both endpoints. SSL is easy and ubiquitous on the web, which is part of why it sucks there.

For point-to-point encryption where you can influence both endpoints, I think anything is on the table, even from a compliance perspective.

i suspect it would decrease the number of attacks against a website…

why do people attack websites? what are attackers trying to get? if they’re trying to get confidential information that people enter into websites then when it suddenly becomes possible to snatch that information right out of the network during transit there won’t be much need to attack the website anymore…