Oh, yeah, forgot to mention one more thing. KVS needs to test all their methods. So even if they're leaving it up to the user to decide whether or not to use some method, they themselves must have, at least while developing that part of the tool, to test that it works. So KVS is every bit as legally liable for any breeches as is the user. Don't recall seeing anyone mention that point till now. Not that it really makes a whole lot of difference if KVS is located in a foreign country (as has been posted), and not readily accessible, being any interested parties may very well just give up before spending a lot of effort/money in trying to track him down. Probably much easier for them to just plug the holes, which seems to be what's been happening all along.