> Non-sequitur. If you can interpose the man in the middle, then most protocols are broken. It does follow. There is no basis for the belief that the transport

> Non-sequitur. If you can interpose the man in the middle, then most protocols are broken. It does follow. There is no basis for the belief that the transport channel isn't secure! For all we know, it's well-encrypted. Yes, MITM is a concern with all communications that are intended to be secure. Granted. Established. Not an argument. But, it's not relevant to this attack. Even using the best crypto available won't save you if the client barfs the security keys to unauthenticated clients upon request. The challenges here are in the authentication and authorization layer, not the transport layer. But there are non-technical constraints at play. Backing up a bit, this even better illustrates the root of the problem. The way the law is written, you can never build a secure system, because the law mandates that the computer in your car trust all clients. Any system that does not secure the channel between an identified client and server is not secure. Hence, when all clients are permitted, the system is not secure by specification.