With regard to the supposed risk of CA's issuing duplicate certs, has that been a problem? You are always complaining that we defend against MITM when it hasn't been a significant attack model, but what about this case, is it something to really worry about?

And did you read what Peter Gutmann said about this idea? "It'd certainly be a good idea to make some distinction, but it's not a productive area to apply effort." Not exactly a ringing endorsement - not a productive area to apply effort!

Cypherpunk,

Yes, I suppose that's true - in that direct MITMs using certs taken from distinct CAs haven't happened in any aggressive sense. We could leave it until then, that is certainly a possibility, and some would say a likelihood.

(Maybe I'm thinking too strategically, too many moves ahead. If the phishers are forced onto SSL, then I don't see it will slow them down much. And there is enough of them that it could be pretty disastrous to confidence in SSL.)

As to what Peter Gutmann said, he was referring not to fighting the MITM, but to the notion of "high"/"low" certs. I've made an annotation to that effect, thanks.