> "Passing the password through MD5 reduces the complexity to 128 bits, you can't get that back."
Attacks against MD5 are based around knowing the original MD5 hash. In this instance, the original MD5 hash is unknown, so there is no mathematical shortcut to finding a collision.
The attacker needs a password with a specific hash, and the best reported attack for that is around 2^128.
Personally, I'm willing to chance that my password will be discovered via a brute-force attack within the next 0.65 billion billion years [1]
[1] http://bitcoin.stackexchange.com/questions/2847/how-long-wou...
A new preimage attack could be discovered - or might already have been, secretly.
No, this is not the problem with MD5. You are not going to find two user-memorizeable-and-typeable passwords with an MD5 collision.
If you are bringing a password with more than 128 bits of complexity to the party, any password storage scheme better than plaintext will have your password safe.
Collisions are a problem for digital signatures, not for passwords.
But some people do want and use more than 2^128 bit passwords, for whatever reason, and an MD5 intermediate stage limits that.
Passing the password through MD5 reduces the complexity to 128 bits, you can't get that back.
So the security level is not the same, though it may be resistant to some attacks on MD5.
And it's probably not important for most people, since there are less than 2^56 eight character ASCII passwords.