3 ms·
When the purpose of hashing is protection of passwords, MD5, SHA1, SHA256, etc. are all effectively equally broken. MD5 vs. SHA1 makes no real difference here.
by meowface 9y ago
When the purpose of hashing is protection of passwords, MD5, SHA1, SHA256, etc. are all effectively equally broken. MD5 vs. SHA1 makes no real difference here.
You can usually tell a company's security posture when they say "all passwords were hashed and salted" without listing the hashing algorithm. If they're using an algorithm actually suited for password hashing, like bcrypt, they'll usually state the name of the algorithm.
- Rjevski 9y agoTo be honest I know that MD5 vs SHA1 or SHA512 is irrelevant in terms of password hashing, but personally seeing SHA512 would make me laugh a little less than MD5. Both are inadequate for this particular use-case, but at least seeing the modern hash would mean they tried to do the right thing.