I think it's relevant to GGP's use of "completely broken" - collisions are far less useful than actually extracting the password string, since one is transferab

I think it's relevant to GGP's use of "completely broken" - collisions are far less useful than actually extracting the password string, since one is transferable and has long-term potential, and the other will probably lose all its value pretty quickly, especially with a change of salt.