MD5 is recognised as an insecure algorithm: given a known hash, there are multiple possible passwords that would resolve to the same hash, therefore appearing to be the correct password.
With MD5, it's not necessary to compute an infinite number of possible passwords, and it is possible that, given a particular hash, a collision can be found within a reasonable time.
I'm leaning towards option a, you read a blog post once and think you're an expert on cryptography now.
> the complexity involved in finding a collision for a specific hash
The theoretical complexity of MD5 is 2^128, but a preimage attack was discovered in 2009 which showed that a collision can be found in 2^123.4. [1]
Collision attacks against MD5 have become more practical, there are even frameworks for it [2]. The complexity of 2^123.4 still makes a preimage attack against MD5 computionally unfeasible, but given that it's been shown to be weaker than its theorerical 2^128, it's possible that MD5 has other weaknesses which would allow the complexity to be reduced to a level that is computationally feasible.
[1] https://www.iacr.org/archive/eurocrypt2009/54790136/54790136...
This isn't the reason that MD5 is weaker than other algorithms.
https://stackoverflow.com/questions/822638/does-any-publishe...
There are collision attacks, but that is not relevant for password cracking.
It's still a big number, but it's less than the theoretical complexity.
[1] https://www.iacr.org/archive/eurocrypt2009/54790136/54790136...