We have recently used a security scanning tool to assess security of an application. It raised a particular configuration as a Medium vulnerability. The claims made in the explanation of the discovered vulnerability don't seem to match with industry standards.
The claim is that "transport mode" security is insecure:
"Transport mode is the least secure option and should be avoided."
This quote above comes from this article relating to WCF security:
The claim here made by HP appears to be that transport layer security, including SSL and TLS, is less secure than message-based security. The article further explicitly states that TLS is susceptible to man-in-the-middle (MITM) attack.
Further research into MITM attacks seems to indicate that the opposite is true: TLS is the preferred way to prevent MITM attack. Resources supporting TLS include:
So, the question is:
Is there any merit in the claim, by the HP article, that transport-mode security is to be avoided, for the reasons cited in that article?
UPDATE: To add some context- the use case in our situation is calling a webservice, not a public site.