4 ms·
I don't think OP suggested otherwise?
by JosephRedfern 9y ago
I don't think OP suggested otherwise?
- ivanbakel 9y agoI think it's relevant to GGP's use of "completely broken" - collisions are far less useful than actually extracting the password string, since one is transferable and has long-term potential, and the other will probably lose all its value pretty quickly, especially with a change of salt.
- cyphar 9y agoWhile "inadequate" and "completely broken" are totally valid qualifiers for those hashing algorithms, the way in which they are broken doesn't affect sha1crypt or md5crypt (only a pre-image attack would break them, collisions are bad but not enough). That doesn't mean you should use them though (you should use bcrypt or similar).