It has a lot to do with the weakness of MD5. You can compute the md5 has of every 6 character lowercase string in seconds on a modern laptop. There are also vas

It has a lot to do with the weakness of MD5. You can compute the md5 has of every 6 character lowercase string in seconds on a modern laptop. There are also vast rainbow tables available. However mozilla have disabled all the accounts that used MD5 anyway. Unfortunately this does not prevent the real risk, which is to people who reuse their password elsewhere. Still, other hash functions such as the SHA512 they are currently using are also wildly inappropriate, as explained in the following excellent post: http://codahale.com/how-to-safely-store-a-password/ http://codahale.com/how-to-safely-store-a-password/