note 50398 deleted from function.md5 by mazzanet

Note Submitter: IndigoDarkwolf ---- This is just a thought regarding security and the benefits of the K.I.S.S. principle (K.I.S.S. means "Keep It Simple, Stupid", and is one of the favorite expressions of English-speaking engineering colleges across the planet): Ever shuffle a deck of cards so many times that it came out less random than you expected? Combining multiple hashes through concatenation of hash-of-a-hash techniques may result in a /greater/ probability of a collision when you're hoping for /lesser/ probability of one. The fact is going to remain that short passwords will /always/ be insecure for the fact that they're short. Long passwords, especially with many kinds of characters, will always be more secure because they're less likely to collide in hashing algorithms (any kind) and they're harder to guess. Consider: Round the Earth's population to 7 billion people. Let's even round that up further to 8 times a power of 2, or (2^3)*(2^30), or 2^33. Keep in mind that this is a very much larger population of the Earth than modern estimates, and we're assuming they all have a password: (2^128)/(2^33) = 2^95. Some orders of magnitude to consider: 2^10 is kilo, 2^20 is mega, 2^30 is giga, 2^40 is tera, 2^50 is peta, 2^60 is exa, 2^70 is zetta, 2^80 is yotta, and to the best of Wikipedia's knowledge there is no term for 2^90. Not that it matters, the mathematicians tell us that all calculations and computations to date amount to about 4 exabytes of data, leaving us several million orders of magnitude shy of a garaunteed collision. Reduce the user count to something reasonable (128 million or 2^37), and the amount of work someone has to do to find a collision becomes unrealistically large. Needless to say, I see no problem with protecting my users' web passwords behind MD5 hashes. The point is: We're talking about some really huge numbers here, a really small population to consume these numbers, and we've already beat to death the computational complexity of guessing these things by chance. Demi-password-guessing by an MD5 hash collision is going to be extremely difficult, and any intelligent person will prefer to attack a weaker portion of your system (ie. go through a window rather than break the lock).