I think you sorta misunderstood, and but also possibly hold some misguided beliefs (like i dont?). The first thing is, there's a lot of things Square could do,

I think you sorta misunderstood, and but also possibly hold some misguided beliefs (like i dont?). The first thing is, there's a lot of things Square could do, and we could both live on the moon eventually also. Their current implementation is a skimmer with all of the logic and safety in the software with all the guarantees of PCI network security beyond that (lol, i bet its salesforce or ec2). On Verifone's end, it's not like we're talking some software-based encraption. Think hardware based asset tags to compliment client certs. Surely it's self-evident that the ease of obtaining what at the moment at best could be a client certificate from a phone and recovering the information from a tamper-resistant device that goes dark if you take it offline too long (rendering the information useless). If they took their device and made it less like a mouse and more like something that tried to tunnel through the stupidest medium ever, I could live with it a little more and see the 'they are stupidly insecure' argument as fud. Second, you realize it took 1 person about a week to reverse, document and develop the PoC for blocking skype (me) and not much longer for a crypto-library from it (accuvant ryan)? A year is a vast over-estimate and im pretty slow at it. If the overall debate pertains to whether verifone did this right or not, I'd agree with you. Although, I have to admit cheering for them with their 'and we will prove it with an app@#@!' part-- if they were consultants they wouldve gotten invited to speak at blackhat. If I had to take a stab at it, after looking at square a little bit. I'd say that if they made the honest argument, Square would try to throw lawyers at them. The honest argument is, 'have you looked at these guys? they're bordering on a criminal-enterprise-by-design, albeit rubber stamped by PCI'. I mean seriously? a point and a half more if I don't have the card and want to enter it on your website instead? (Also the hubris in their research & disclosure policy made my blood boil)