To me, what Coviello is saying is don't worry the thieves haven't stolen some secret 0-day that would provide them immediate access through your RSA kit I am n

To me, what Coviello is saying is don't worry the thieves haven't stolen some secret 0-day that would provide them immediate access through your RSA kit I am no security expert (far from it!), but I've seen enough compromise disclosures with inside information to read this the exact same way as you, especially with this note from the advisory: We recommend customers enforce strong password and pin policies. Advisories like this are like poetry: every word matters, and a phrase like "... reduce the effectiveness of a current two-factor authentication implementation as part of a broader attack" is too pretty to not raise my suspicion. RSA could be 100% busted, and this phrase would still be technically true.