Coremetrics doesn't seem to show this system that they've unleashed enough respect and they don't seem to understand its full potential. In its release, Coremetrics has made several statements that simply are not correct. Coremetrics, in our opinion, needs to spend less time talking about what their policy is and more time getting their technical people to talk about what is technically possible . No one knows better than we how differences between policy and possibility become real vulnerabilities. We have no evidence to suggest that they're actively doing this today.
Nobody designs a system to be compromised.
The fact of the matter is that security problems happen as a result of failure of policy. So if their policy fails in any way, we have no protection against abuse of this information. We can establish that it's a risk. Only time will tell. What we are saying is that it's a risk that users have not agreed to take and it is they who are being burdened with the risk.