News for hackers. Stuff that matters.

A comment on We didn't encrypt your password, we hashed it. Parent comment

Re:We didn't encrypt your password, we hashed it by sillysaurusx on Friday September 04, 2020 @06:32PM (#24379552)
MD5 is broken, but HMAC-MD5 is still impossible to break afaik. And md5(pepper + md5(pw)) is basically HMAC.

Not commenting on the overall idea, just pointing out that the criticism of md5 happens not to be valid in this case. I was surprised too.

[ Parent | on HN ]
Re:We didn't encrypt your password, we hashed it by hatsunearu on Friday September 04, 2020 @09:00PM (#24380542)
The discussion of "MD5 collision resistance is bad, but md5 preimage resistance is still ok, so using md5 for applications where preimage resistance is required is ok" is I think completely valid (however pointless it is)

However for password hash functions to be useful they also need to have a high work factor to make brute forcing even more difficult.

[ Parent | on HN ]