I am equally skeptical about the SHA-1 claim. I am just commenting that as a general rule customer protection falls under the purview of the FTC. There are cert

I am equally skeptical about the SHA-1 claim. I am just commenting that as a general rule customer protection falls under the purview of the FTC. There are certainly corner cases where industry specific regulations introduce additional oversight when it comes to customer information protection, e.g. OCC/OTS/NCUA and GLBA[1], or HHS and HIPPA[2]. [1] http://www.occ.gov/news-issuances/news-releases/2005/nr-ia-2005-35.html http://www.occ.gov/news-issuances/news-releases/2005/nr-ia-2... [2] http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/index.html http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachno... Side Bar: If you are bored and want to get your wonk on search regulations.gov for sha-1[a]. It looks like most of the proposed rules mentioning SHA-1 come from HHS, FRA (Federal Railroad Administration) and the NIGC (National Indian Gaming Commission). However there is one reference to SHA-1 in an FCC rule about the Commercial Mobile Alert System[b]: CMAC-digest Optional element. The code representing the digital digest (``hash'') computed from the resource file. Calculated using the Secure Hash Algorithm (SHA-1) per [FIPS 180-2]. Alert Gateway uses the CAP digest element to populate this element. [a] http://www.regulations.gov/#!searchResults;rpp=25;po=0;s=sha-1;fp=true;ns=true http://www.regulations.gov/#!searchResults;rpp=25;po=0;s=sha... [b] http://www.regulations.gov/#!documentDetail;D=FCC-2008-0002-0001 http://www.regulations.gov/#!documentDetail;D=FCC-2008-0002-...