A. Lenstra et al. had a paper in 2012 "Ron was wrong, Whit is right", in which one reads: "What surprised us most is that many thousands of 1024-bit RSA moduli, including thousands that are contained in still-valid X.509 certificates, offer no security at all." Has that surprise been satisfactorily explained in the meantime? I'll be particularly interested in cases where the moduli had shared factors. I mean that seems to indicate a fairly high probability that back doors could have been involved in the software that generated such moduli.