note 56001 deleted from function.md5 by mazzanet

Note Submitter: bucketbot ---- alex at blackkettle: "Your scheme is almost certainly less secure than md5 alone would be" Not true. The method Harry uses does not trade "a little security for a little obscurity". None of the actual password plaintext is revealed in the stored value. The *random* seed is stored because it is random and would otherwise be unrecoverable. Harry's method doesn't reduce the number of passwords that a brute-force would have to check and in fact, if the attacker cannot see the code, they would not know if the stored value was md5 or sha1. The main advantage is that passwords will never have the same md5 hash because they are compounded with a random seed. An attacker would have to add the seed for each check. Adding the obscurity of md5/sha1 is another barrier for an attacker to get past and it's a good idea.