note 16953 added to function.md5

On MD5 security: Your attacker did not attack the hash algorithm but the passwords (usually THE weakest link of any authentication system) to get decent entropy into a password you need 13-15 pseudo-random (ie. they seem random but you have some rules for remembering them) characters, even these can be cracked within a month or so if the attacker has a distributed cracking program (like in your case) and a few number computers to do the number crunching (this is why we should change our passwords monthly). Anything that is either a dictionary word (40MB word list is a LOT of words), or only slightly varies (few chracters added to end or beginning of the word) from a dictionary word will be broken in matter of seconds. To get security you could use SSL or IPSec (depending if it's web or more general networking) with client-side certificates stored on crypto hardware (so the certificate never leaves the secure environment, the hardware handles signing authentication packets), smartcards require (rather expensive) readers, I would go with USB tokens (they look sexier too). -- http://www.php.net/manual/en/function.md5.php http://master.php.net/manage/user-notes.php?action=edit+16953 http://master.php.net/manage/user-notes.php?action=delete+16953 http://master.php.net/manage/user-notes.php?action=reject+16953