MD5 found to be insecure

[Reeve of shinra]

<a href="http://news.zdnet.co.uk/internet/security/0,39020375,39163876,00.htm" target="_blank">http://news.zdnet.co.uk/internet/sec...9163876,00.htm</a>

The above article (from cnet actually) talks about recently discoved flaws in the MD5 hash and in SHA-1 algorithm that could theoritically make them susceptible to hackers with an array of PC's.

I guess nothing can last forever, but (to keep it vb related), do you think that vb's double hash + salt password routine will put the block on such attempts as this?

[j_86]

This is fairly old news.

MD5 hash's are not backward compatiable, and as described in the article, you may get the possibility that one string may hash into the same MD5 signature as a different string - this has always been the base, but is highly unlikely to happen.

26 letters in the alphabet - a md5 string of (12 or 16 characters? I can't remember) means there there are a HUGE number of possible hash keys.

BUT, not to mention, MD5 uses numbers 0 - 9. 10 digits, in any combination coupled with the 26 letters of any combination gives astronomical numbers of possible combinations.

V-bulletin goes on step further, to increase this randomness and thus reducing the odds even more, that the same key is genreated by using SALT.

Nothing is ever secure, but for we typical users, you don't get more secure realtranslation encryption as MD5. ( not to mention + SALT).

[Revan]

Plus the fact that unless you hold extremely valuable stuff on your forum, hackers wont bother with the abovementioned array of PCs just to break your password
(this was NOT an attempt to undermine the point of Reeve's post, it was PURELY looking at the vB side of the news. (because it was news to me ))

[Modin]

There's many projects out there who are compiling a list of md5 hashes and their keys. So yeah, nothing is really "uncrackable". Just keep that in mind when you do stuff on the web, and you'll be fine.

[AN-net]

wow didn't know that but if someone is going to go through millions of factors in the 2x MD5 + SALT just to get a password i would rather give them an award for wasting a significant amount of time on something so unsignifcant as a forum password Anyways im shocked that SHA-1 is flawed since its a government standard and i dont feel safe knowing a hacker can now hack in and get government info....