[Brad]

Originally Posted by Marco van Herwaarden

@Brad,

You forget that it is a double md5(). Bruteforcing a MD5-hash would take you decades, even on very fast computers. The only (reasonable) way to get a md5 is to use rainbow tables, and as far as i know there have never been any created for double md5's.

I never said I'd get it in a timely manner. It was stated that it was impossible to get the password, I'm saying it is possible in theory and that leads to begin possible in pratice. It may take years and years to do it but it is possible.

I understand that it's doubled md5ed and a salt is used to make it harder. But the fact remains that the routine for storing and generating that data is known to anyone that can read the source code. If I know the routine, and have the data from the user table, and have the computing power to throw at the problem I will end up with a working password at some point.