Dan Kaminsky had a good talk[1] regarding this on 26c3, where he essentially argued that the only reason we have TLS at all is because companies selling stuff over the Internet wants to make it seem secure for the customer. State actors or large companies interested in data mining are not that interested in committing credit card fraud, so every one just accepts the PKI status quo more or less.<p>Or that was what I took away from what he said. I havn&#x27;t seen the complete talk since he held it.<p>[1] <a href="https:&#x2F;&#x2F;events.ccc.de&#x2F;congress&#x2F;2009&#x2F;Fahrplan&#x2F;events&#x2F;3658.en.html" rel="nofollow">https:&#x2F;&#x2F;events.ccc.de&#x2F;congress&#x2F;2009&#x2F;Fahrplan&#x2F;events&#x2F;3658.en....</a>