3 years ago, an MD5 collision was exploited to allow the creation of a fraudulent CA certificate! http://www.win.tue.nl/hashclash/rogue-ca/ http://www.win.tue.

3 years ago, an MD5 collision was exploited to allow the creation of a fraudulent CA certificate! http://www.win.tue.nl/hashclash/rogue-ca/ http://www.win.tue.nl/hashclash/rogue-ca/ Basically they could create HTTPS certificates for any domain (microsoft.com, gmail.com, etc) and it would be shown valid by the browser. So MD5 collisions really are useful in practical real-world attacks.