How to identify & protect from hacked SSL MD5 certificates

When I look at my "certificates" in Firefox, for Gmail, for example, it
says SHA1 fingerprint and MD5 fingerprint, e.g., for Thawte SGC CA (i.e.,
mail.google.com).

Does this mean this is a site that can easily be compromised?

If so, what do we do in Firefox 3.0.5 on Windows to protect from a spoofed
site?

On Tue, 30 Dec 2008 22:18:30 -0800, (E-Mail Removed) wrote:

> Is there a way to protect ourselves today from this flaw?

I found the answer. Yes. We have to look inside the certificate to see the
"tumor", which is relatively easy to find once you know what to look for.

Mozilla did release an advisory
http://blog.mozilla.com/security/200...icate-forgery/