Everyone using a one of a few cloud providers means lots of golden eggs in very big baskets. Sure, everyone deploying things on-prem will mean attackers will f

Everyone using a one of a few cloud providers means lots of golden eggs in very big baskets. Sure, everyone deploying things on-prem will mean attackers will focus on the software instead of the cloud vendor. But that's A∨B vs. only B. > - One IT department I worked with used a VPN which used an MD5 certificate. This was between 2010 and 2020. MD5 was cracked and it meant anyone could preform a man in the middle attack. MD5's collision resistance has been broken. Corporate VPNs are often deployed by shipping the cert's pubkey on each client. In that case you're not using PKI which means the switcheroo attack involving collisions aren't relevant and you only need to rely on MD5's preimage resistance which is still ok. So while using MD5 doesn't smell great it's not necessarily an open barn.