4 ms·
Even so, the fact that we have the knowledge to generate collisions in MD5 means you really shouldn't be relying on it when there are better alternatives.
by joatmon-snoo 10y ago
Even so, the fact that we have the knowledge to generate collisions in MD5 means you really shouldn't be relying on it when there are better alternatives.
- imaginenore 10y agoTry and generate a collision with the hash I gave. You can't, as far as I'm aware. We can only generate collisions of carefully crafted sources, not arbitrary ones. So MD5 is fine, as long as you follow the standard procedure for storing password hashes: 1) Unique salts + long master salt (to prevent rainbow table lookups). 2) Enough rounds of hashing. 3) Don't allow the most common passwords. 4) Don't allow very short passwords. I'm not saying MD5 is ideal, I use Bcrypt / Scrypt myself. But it's not MD5's fault Yahoo's engineers are lame.