My point was that you characterized the act of stealing them as waiting for a good exploit to come along and then finding a poorly secured box that you can target. Which says that for most developers, worrying about it is Someone Else's Problem. It also comforts a lot of people that they are OK because they have a firewall in place.

Ahh, I see what you're saying now. Certainly, just because you have a firewall in front of your database doesn't make you secure. I pointed it out only because an awful lot of places don't have a firewall in place, and often store cleartext CC nums, and there is nothing SSL or anything else client-side can do to change that fact.

SSL doesn't solve your basic problems, but it is an easy thing to do that does solve some that come up.

Agreed. SSL is out there, it works, and it's reasonably easy to set up. I only wanted to point out that well-meaning people have taught Aunt Nellie that if that little padlock shows up at the bottom of the browser, her CC num is secure, when it often isn't. As long as the Internet community already went to all the trouble to get SSL working, we might as well use it. However, it's by far not the weakest link in the chain.