, 2009-01-05
A few days ago at the Chaos Communication Congress in Berlin, researchers presented a paper in which they had used an MD5 collision attack and substantial computing firepower to create a false SSL certificate using the RapidSSL brand of SSL certificate. In the intervening time we have seen a great deal of confusion and misinformation in the press and blogosphere about the specifics of this attack and what it means to the online ecosystem.
Expand all |
Post comment
MD5 Hack Interesting, But Not Threatening
2009-01-06
Charlie Miller (1 replies)
Charlie Miller (1 replies)
Re: MD5 Hack Interesting, But Not Threatening
2009-01-06
Robert Lemos (5 replies)
Robert Lemos (5 replies)
Verisign were notified about this work prior to the presentation
2009-01-06
Alexander Sotirov (1 replies)
Alexander Sotirov (1 replies)
MD5 Hack Interesting, But Not Threatening
2009-01-08
Charles Hunter (1 replies)
Charles Hunter (1 replies)
Re: MD5 Hack Interesting, But Not Threatening
2009-01-09
Robert Lemos (2 replies)
Robert Lemos (2 replies)

Sorry for the late reply. To answer your question, I found the column directly from the main page.
As one other person noted in this thread, I wasn't confused that this was a columnist, I was annoyed that the person's role/background/influece wasn't disclosed up front.
Like I said, it's no crime to hear from Verisign... they deserve to be able to have their side heard. The article or the by line or something should have clearly said who he was representing though. This way you are reading the article to understand verisign's take on the issue. Otherwise, you'll be reading an article you presume to be from a researcher or some other neutral party that you inevitably come to realize is not. That leaves the reader feeling mislead. Even if the columnist is correct in his opinion, you still feel tricked in a small way. You don't want Security Focus readers 2nd guessing your sources. Don't introduce doubt for no reason. Simply introducing this person as "Tim Callan, Verisign" would have been enough since you have a proper disclosure at the bottom. Myself, I'd prefer "Guest Vendor Columnist" or something like that.
Security Focus should not be worried that people will blow off the articles if they're called out up front. This is not supposed ot be a fluff piece or a product pitch ( and this article wasn't ) so there's no worry.
[ reply ]
Link to this comment: http://www.securityfocus.com/comments/columns/488/35331#35331