If you care about your security (or as a service provider, the security of your users) and if you can't establish a chain of trust, then you can't call a soluti

If you care about your security (or as a service provider, the security of your users) and if you can't establish a chain of trust, then you can't call a solution secure. If the connection is encrypted, then you have to trust the certificate authority, the browser and the service provider. If the connection is unencrypted, then in addition to the above, you have to trust that nobody is listening on that connection and that's a really tough pill to swallow, even if nothing bad happened to you in the past (just like with car accidents, it needs to happen only once to mess up your life). If you don't think bad things happen all the time in the wild, see this story of Ashton Kutcher's Twitter account being hacked while attending TED: http://www.huffingtonpost.com/2011/03/02/ashton-kutcher-twitter-hacked_n_830619.html http://www.huffingtonpost.com/2011/03/02/ashton-kutcher-twit...