Hacker News Reader

Just to clarify, this makes a collision attack feasible, not a preimage attack.

That means (iirc) someone can create two messages that have the same hash - but not create a message that has a particular hash.

Still not ideal - but not terrible. It still wouldn't be feasible, for example, to bruteforce a password from its hash.

You can still inflict a lot of damage if you can create collisions. Producing a rogue CA is just one possibility.

The potential for intentional collisions makes it critical that an attacker cannot control or predict all of the inputs to your signing operation.