> So even md5 stolen from Steam Guard wouldn't help much in the case of a long password (Though, with unsalted md5 or sha1, it's possible to find a shorter col

> So even md5 stolen from Steam Guard wouldn't help much in the case of a long password (Though, with unsalted md5 or sha1, it's possible to find a shorter collision instead. But afaik it requires executing specific techniques instead of the regular algorithms, and obviously the Steam server isn't doing that, so it must be done locally with a stolen hash.)