Length extension attacks were actually used to attack a number of commercial web message authentication schemes such as one used by Flickr.
Attackers used length extension tactics against several commercial web message authentication systems, such as the one employed by Flickr.