Yeah it reads as if the OP misunderstands the attack vectors of SSL. If there's a misconfiguration, or the server admin is not correctly authenticating the aut

Yeah it reads as if the OP misunderstands the attack vectors of SSL. If there's a misconfiguration, or the server admin is not correctly authenticating the authority, then sure. But skips over what they mean. Being generous I would say they are referring to if the client has an invalid ssl approved on their local, in which case its a client problem. To ignore Encryption altogether is a silly idea. Maybe it shouldn't be so centralised to 1 company though.