The proper answer is to use something like SHA-3, which relies on an entirely different, simpler yet more powerful design. The underlying problem here is, conce

The proper answer is to use something like SHA-3, which relies on an entirely different, simpler yet more powerful design. The underlying problem here is, conceptually, that together with the hash you release the entire state of the "hashing machine". SHA-3, to simplify a bit, truncates the output bitstring, and therefore does not release the entire state of the hashing machine. Length extension attacks are in every crypto 101 class, everyone who designs crypto systems knows about them and acts accordingly. For example by using Galois field arithmetic to generate authentication codes, not hash functions (bonus: it is faster).