Hector Martin

Remember, this SHA1 attack is *not* the attack that broke MD5 TLS certs and gave us Flame. *This* attack on MD5 you can run on a smartphone.

This SHA1 attack does NOT allow you to collide an innocent-looking file with a malicious file. You need TWO blatantly malicious files.

... of course, if nobody's looking at the hex dump, one of those files might not look malicious when you open it. Hence the PDF trick.

Similarly, you could make two colliding binaries and have them behave differently, but the "evil" code would have to exist in both.

This is the last nail in the "but it isn't broken yet" excuse to keep using SHA-1, so if you haven't *started* migrating yet, start *now*.

Hash attacks 101: preimage=any clean file; chosen prefix=64b of junk in otherwise clean known file; same prefix=both files evil.

preimage=we're screwed (not even MD*2* is preimage-broken); chosen prefix=Flame, git totally broken; same prefix=git safe-ish for code.

If you're putting binary files in Git without carefully vetting their contents, time to start pestering the devs to switch to a better hash.