{"thread":{"id":"38033","subject":"Re: How safe are signed git tags? Only as safe as SHA-1 or somehow safer?","startedAt":"2014-11-24T00:52:42Z","lastAt":"2014-11-24T00:52:42Z","messageCount":1,"participants":["bancfc@openmailbox.org"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"252414","messageId":"6246f36ca7006d29b97f2e453c9e52c8@openmailbox.org","threadId":"38033","inReplyTo":null,"subject":"Re: How safe are signed git tags? Only as safe as SHA-1 or somehow safer?","fromName":"","fromEmail":"bancfc@openmailbox.org","sentAt":"2014-11-24T00:52:42Z","receivedAt":"2014-11-24T00:52:42Z","isPatch":false,"sender":{"key":"bancfc@openmailbox.org","avatar":null},"body":"Hi, I wanted to chime in on the topic of SHA1 weaknesses and breaks. The \nproblem is idea that SHA1 breaks are theoretical and will only  be \nrelevant in a decade or two.\n\nI think its a telling sign when even companies like Google [1] and \nMicrosoft [2] who collaborate with spy agencies are moving away from \nSHA1 in verifying browser certs and the estimates by reputable \ncryptographers already put us in the realm of feasible breaks at this \ntime, with the bar going lower with every passing year [3]. In three \nyears common cyber criminals will be able to crack it using moderate \nsized computer clusters or by renting some AWS cycles.\n\nPlease reconsider the urgency of moving away from SHA1 for security \nfunctions in Git.\n\n\nReferences:\n\n[1] \nhttp://thenextweb.com/google/2014/09/05/google-will-start-sunsetting-sha-1-cryptographic-hash-algorithm-chrome-month-finish-q1-2015/\n\n[2] https://www.schneier.com/blog/archives/2013/11/microsoft_retir.html \n(Schneier on Security: Microsoft Retiring SHA-1 in 2016)\n\n[3] https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html \n(When Will We See Collisions for SHA-1?)\n"}]}