Yes, I’m crystal clear on the difference between authentication and encryption. > The transport (https) might be encrypted, but that’s not what anyone cares ab

Yes, I’m crystal clear on the difference between authentication and encryption. > The transport (https) might be encrypted, but that’s not what anyone cares about. I was referring to transport encryption. Paul was rather vague about what he meant by unencrypted, and if there’s no transport encryption this is a breathtakingly big issue. So I’d argue that people do/should care about this. Data encryption would obviously be ideal, but in my mind, that wasn’t even the initial bar to clear after a claim of “unauthenticated and unencrypted”. The biggest issue with all of the communication up to this point has been a lack of precision/specificity, and that has led to multiple interpretations of the findings and plenty of misunderstanding.