I would like to see someone knowledgeable explaining this. Using hash function designed for speed as way to encrypt passwords seems at best not very thoughtful and at worst completely stupid. Why are so many (maybe most?) services using it ?

The short answer is that it doesn't matter because if you live in a fantasy land where users never re-use passwords, always have passwords with sufficient entropy, or you never lose control of your data, doing key-stretching is not necessary or helpful.

The long answer is that security experts are expensive and trying to figure out security systems from first principles is very hard and fraught with disaster. The result is that almost all security practices are transmitted via folklore.

Also, the documentation for security software is often dense and hard to understand, while the documentation for non-security software provides advice that is simple, actionable, and terrible: http://dev.mysql.com/doc/refman/5.7/en/encryption-functions....

* The undocumented-algorithm PASSWORD() function that mysql uses to hash passwords apparently defaults to unsalted double-SHA1

* You are helpfully advised not to use this function to store user passwords, instead you're advised to use MD5 or SHA2.

* Salting is not discussed at all.

* Key stretching functions are not provided or discussed.

Laziness or ineptitude. In case they are using MD5 or SHA1 due to legacy systems then migrating passwords to a new encoding is troublesome at best and impossible at worst.

Many tutorials and reference documents use MD5 and SHA1 in their coding examples, so right from the get-go novice developers are at an automatic disadvantage.

then make people reset their password , force them if necessary.

cryptographic hash functions are crypto primitives (=building blocks), and very useful such. The hash function is simple and fast by itself but can be used in safe constructions. This is completely fine. One example is PBKDF2 using HMAC-SHA-1 and many iterations.

Exactly, in transit or temporary data vs long term stored (in place) data.

Could be worse. My bank doesn't even hash their passwords at all.