A thousand rounds of MD5 is absolute insanity, I mean that's the sort of thing that gets you banned from ever writing security critical code ever again. The cos

A thousand rounds of MD5 is absolute insanity, I mean that's the sort of thing that gets you banned from ever writing security critical code ever again. The cost of an MD5 cycle is basically zero. Zero times a thousand is still zero. Zero times a million is zero. It's got zero value in terms of protection. Even SHA1, which is a much harder hash to compute, can be processed at trillions of hashes per second on some hardware. If you did a million cycles of SHA1, guess what? That thing can still crack a million guesses per second. Bcrypt has a difficulty number you can pin at a level that's uncomfortably high. It may take 200ms to verify a password if you really crank it. That means you can't do thousands of hashes per second, but you're stuck doing maybe a thousand hashes per minute. You can't dictionary attack that. I know how the collision vulnerability works. People have been creating MD5 collisions for fun for a while now, unconcerned with the original hash. If they focused their effort on matching hashes, they could probably do it by exploiting fundamental weaknesses in the MD5 hash system itself. At this point a sufficiently robust SAT solver can probably crack it. All your hand-waving about disallowing easy passwords doesn't matter. If you add restrictions, people find ways around them. It also doesn't matter if you make passwords incrementally harder if someone can crack them easily. Their computer doesn't care if they set it to search ten characters instead of eight, modern crackers are pretty efficient to fairly intimidating lengths.