[lotuseclat79]

Web browser flaw could put e-commerce security at risk.

Note: This vulnerability is not actually a web browser flaw (which is the title of the c|net.com article only), but an MD5 certificate flaw.

Key point: Stop using MD5 certification!

-- Tom

[lotuseclat79]

Here is an informative article about the flaw which is quite illuminating:
Theoretical attacks yield practical attacks on SSL, PKI.

Note: Extended Validation certificates that cause green or gold address bars in many browsers are also immune to this problem, as EV certificates prohibit the use of MD5. Simply looking for a padlock icon is no longer enough to be sure that communication with the remote server is truly secure.

-- Tom