I'm baffled by this. I think what's happening is similar to the streetlight effect, also called a drunkard's search. We're focusing on the wrong problem. The a

I'm baffled by this. I think what's happening is similar to the streetlight effect, also called a drunkard's search. We're focusing on the wrong problem. The article claims SHA-1 is "increasingly vulnerable to potential collision attacks". Aka, theoretically vulnerable, not demonstrated yet. But there's all this frantic activity to fix this. For some reason it's interesting to a lot of people. Here's why I'm confused. There have been very real, in the wild, documented MITM attacks against users due to malfeasance of certificate authorities, many of which are state actors. And yet, today, my copy of Firefox 43.0.1 still has a plethora of CAs it trusts (for all domains?). Including trusting known bad actors such as TÜRKTRUST. I think that truly fixing the CA mess should be infinitely higher priority than worrying about SHA-1. Why doesn't my browser implement proper pinning for every site it visits? Okay, so Chrome pins some Google certificates. But 99% of the Internet is vulnerable to MITM and everybody just wrings their hands and promises eventual future fixes. Moxie Marlinspike has been calling attention to this for years. But I don't follow the certificate pinning stuff carefully. Has the problem been solved? I've previously used Certificate Patrol, but that software had some serious limitations so I gave up on it.