Some very clever people have figured out how to create an exploitable real world MD5 hash collision. It is interesting work and suggests that the value of an MD5 signature to verify a certificate is lower than intended. In the end the work shows it is possible to spoof a web site in such a way that a browser’s normal security features for detecting false websites are defeated. But does it really matter?
That presumption, that a CA would be meaningful in preventing phishing or redirection or whatever by uniquely identifying a site as belonging to the entity in question because the user trusts the domain name, is prima facia absurd. Would you even think about going to www.bofa.com instead of www.bankofamerica.com or whatever? I wouldn’t; most banks would buy every variation of their name including common misspellings (www.bnkofamerica.com?), so that a misspelling seems to work wouldn’t surprise me at all. That a misspelling gets a cert thus means nothing either.
Further, what do you do when a cert fails, for example if the CA can’t be identified or the cert is expired or whatever? Do you back out of the transaction and call the bank to find out what’s going on? Do you think you could ever reach anyone at the bank who knew? Send them an email? (which would probably go to the fake bank anyway). I just accept the cert and move on.
Since CAs and certs are already a complete failure as a proof of identity mechanism, MD5 signature spoofing is also irrelevant for the vast majority of users.
HTTPS is useful for encrypting traffic. It shouldn’t be used for anything else. The whole signed CA/Cert thing is an impediment to this useful function for a useless feature that is merely cryptographically entertaining. Google’s and various browser mechanisms to identify malicious sites are far more effective, although a few users are likely to get scammed before the fraud is identified.
