There's something about the way that this is written that rubs me the wrong way. There's a lot of emphasis on how unlikely the attack would be - that the collision would take "significant resources", that many conditions must be true at the same time, that Pulse Security's proof was unrealistically simple.
All of this can be true, but rhetorically, it sends the wrong message to put so much emphasis on this. The message I'd like to see would be more like this:
"We got notified of this security problem. We immediately worked on mitigation and to find out if any customers were affected. We couldn't find any, and we have patched the problem. We have a patch for you to apply to fully prevent the problem.
The problem depended upon an identity collision. We think the probability of this is remote, but we always take this stuff very seriously."
In other words, I want to see platforms like this emphasize their response, rather than try to convince me that the problem is minor. The way these things are phrased matters a lot!
All of this can be true, but rhetorically, it sends the wrong message to put so much emphasis on this. The message I'd like to see would be more like this:
"We got notified of this security problem. We immediately worked on mitigation and to find out if any customers were affected. We couldn't find any, and we have patched the problem. We have a patch for you to apply to fully prevent the problem.
The problem depended upon an identity collision. We think the probability of this is remote, but we always take this stuff very seriously."
In other words, I want to see platforms like this emphasize their response, rather than try to convince me that the problem is minor. The way these things are phrased matters a lot!