note 16953 deleted from function.md5 by jimw

On MD5 security: Your attacker did not attack the hash algorithm but the passwords (usually THE weakest link of any authentication system) to get decent entropy into a password you need 13-15 pseudo-random (ie. they seem random but you have some rules for remembering them) characters, even these can be cracked within a month or so if the attacker has a distributed cracking program (like in your case) and a few number computers to do the number crunching (this is why we should change our passwords monthly). Anything that is either a dictionary word (40MB word list is a LOT of words), or only slightly varies (few chracters added to end or beginning of the word) from a dictionary word will be broken in matter of seconds. To get security you could use SSL or IPSec (depending if it's web or more general networking) with client-side certificates stored on crypto hardware (so the certificate never leaves the secure environment, the hardware handles signing authentication packets), smartcards require (rather expensive) readers, I would go with USB tokens (they look sexier too).