-1

I have seen many companies that are using MD5 to hash their passwords, and it seems like most of them don't want to change algorithm. My question is why are they still using it?

Many say that MD5 have big weaknesses and is too fast so it can be easily brute forced, but I'm mostly oriented at phpBB and MyBB because I saw that they also use MD5 for password hashing.

Also even if is opinion based, maybe they choose MD5 instead of other hash algorithm, because of some reason.

Improve this question
6
  • We try to avoid questions that are primarily opinion-based, or that are likely to generate discussion rather than answers. – Krishna Pandey Dec 16 '16 at 22:25
  • 2
    Very similar to the recent Yahoo question (security.stackexchange.com/questions/145415/…) and just as likely to be based on opinions rather than first-hand knowledge. – PwdRsch Dec 16 '16 at 22:28
  • I think phpBB and myBB use PHPass, which does at least add a salt and a couple of rounds of hashing to MD5. I suspect these projects do it for backwards compatibility. PHP didn't get decent built-in password hashing until somewhat recently and PHP users tend to use very outdated versions. – Alexander O'Mara Dec 16 '16 at 22:31
  • answer like the company just choose md5 is also acceptable, but maybe there is something that is because they want to use md5 instead of sha – Daniel Dec 16 '16 at 22:31
  • If the question is "Why did Yahoo stick with md5?"? then, to my knowledge, the info probably isn't out there yet to answer that well. If the question is " What are common reasons that large companies might stick with highly outdated password hashing methods?" that question strikes me as probably "answerable." Even if in a general way. (Assuming it's not a duplicate.) – mostlyinformed Dec 16 '16 at 23:49
5

The most probable reason is cause programmers rarely are security wise trained. In most cases they aren't interested in searching best practices or they don't have the time

With this in mind a programmer may take a look at MD5, a widespread hashing function, mentioned in a lot of books and forums as a fast hash function with short output and see it as a well optimized function in aspects of timing and space consumption

And once the system is made any change is painful, specially when programmers are awarded for developing new functionalities fast. Security needs to be at the begining of the software development process and should be reviewed in a regular basis, something that some companies see as a slowing step

But it's just speculation

Improve this answer
1
  • For a great many companies, this would be a great answer. But for a company with the size, resources, and organizational experience of Yahoo...there had to be security people, inside the org or out (probably both) saying that this was.inadequate. As for why those people weren't listened to (as late as 2013)? At this point, I don't know that there's enough publically-reported info to do anything but guess. (Yahoo would be far from the first company to let defense-in-depth measures go by the wayside. But, as I said, right now the specific reasons for that in Yahoo's case remain hazy, AFAIK.) – mostlyinformed Dec 16 '16 at 23:35

Not the answer you're looking for? Browse other questions tagged or ask your own question.