I found this article to be not much more then a waste of space on security focus. I would think someone from verisign would have more since then to say this is not a serious issue. The simple fact of the matter is, there are people out there with the computational power to successfully recreate attacks such as this with great ease. Think foreign governments and botnet owners - the kind of people you don't want exploiting flaws like this at all. The US Gov and other gov's have long been known to have been exploiting ssl cert authentications for uploading code to peoples browsers during attacks. Think - what certs come default as trusted in windows *wink*. This past year has seen a rise in discovery of older flaws that have long affected our Internet's infrastructure. This and Dan (I-worked-on-dns-all-my-life-and-finally-found-a-bug) kaminsky's DNS flaw are prime examples of this. These flaws need to be taken more seriously despite what some idiot with a blog thinks.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/488/35315#35315