"So if you know about this, you can make it produce a valid certificate." Since Filippo Valsorda already went public with the same findings (I held off on the

"So if you know about this, you can make it produce a valid certificate." Since Filippo Valsorda already went public with the same findings (I held off on the details and let the community figure it out while working with the vendor), here's the thing. SSLSplit does wildcard SAN out of the box. Any WiFi Pineapple with the SSLSPlit infusion can be up and running, MitM'ing Superfish in no time at all without even knowing about the Superfish SAN validation issue. As such, it wouldn't surprise me at all if people MitM'ing WiFi connections already got in the middle without even trying. Keep in mind that Superfish was running on consumer convertible devices like the Yoga 2 which functions either as a laptop or tablet, in short, a device you'd expect to be connecting to WiFi nearly exclusively, thus making the attack surface much larger than a desktop machine connected via a LAN cable to your DSL router.