<i>&gt;I don&#x27;t care about why the bug happened or how easy it is&#x2F;isn&#x27;t to fix. I care about whether the existence of the bug is something I should be so concerned about as to not use the software. In order to gauge that, I need a little more info about the threat level.</i><p>Threat level is 0%. No currently known attacks exist. This threat level immediately goes to 100% when a practical attack is discovered. There is no guarantee that a practical attack exists that <i>hasn&#x27;t</i> been brought to academic or mainstream attention (e.g some cracker has a practical attack that they&#x27;re keeping under wraps). By the time the threat level hits 100% the cracker may have already broken into your account(s) before you even hear about the attack.<p>Therefore when something is shown that &quot;attacking it is possible&quot; you can make one of two assumptions<p>1) No practical attack exists and you&#x27;ll be safe until it exists<p>2) A practical attack already exists and it is only a matter of time until you get pwned<p>Rather than worry about whether or not a practical attack already or will one day exist, I&#x27;d use cryptography that hasn&#x27;t been shown to be broken.