Oh, yea, no doubt that the payment side could also be a lot better. No arguments here.

My only point is that on the payment side, the technology doesn't provide any security, but the legal framework does. But from the password management side, you're in a technology danger-zone for security, and the legal framework says "caveat emptor", so I think that one is the "worse" problem of the too.

But, I agree, the payment side should be improved