Hacker News Reader

I thought the 40-bit keys were used due to cryptographic export restrictions, and not lack of randomness?

Seems to agree with me.

The authors didn't cite Netscape because the 40-bit key is too short, they cited it because the the PNRG in the SSL implementation was faulty.