Quoth the article:<p><i>That means that if you know SHA1(secret || message), then you can compute SHA1(secret || message || ANYTHING), which is a valid signature for message || ANYTHING. So to break this system, you just need to see one signature from SuperAnnoyingPoke, and then you can impersonate SuperAnnoyingPoke for lots of other messages.</i><p>This is absolutely incorrect.  If you know SHA1(secret || message), you can compute SHA1(secret || message || padding || anything), which is quite a different matter.  Most useful values of "anything" don't start with such padding.<p>Should anyone be designing a system which relies on this distinction for its security?  Of course not.  But things are bad enough already without exaggerating the scope of attacks.