Loading...
Loading...
Using MD5 for password hashing provides inadequate security against modern attacks.
1import hashlib23def register_user(username, password):4 password_hash = hashlib.md5(password.encode()).hexdigest()56 db.users.insert_one({7 'username': username,8 'password': password_hash9 })10 return True1112def verify_password(username, password):13 user = db.users.find_one({'username': username})14 if not user:15 return False1617 input_hash = hashlib.md5(password.encode()).hexdigest()18 return input_hash == user['password']
MD5 is a fast hashing algorithm, making it vulnerable to brute-force and rainbow table attacks. It also lacks salting, meaning identical passwords produce identical hashes. Modern password hashing requires slow algorithms like bcrypt, scrypt, or Argon2 with unique salts.
Attacker uses precomputed hashes to crack passwords
# Password hash from leaked database:
5f4dcc3b5aa765d61d8327deb882cf99
# Lookup in rainbow table:
hashcat -m 0 -a 0 hash.txt rockyou.txt5f4dcc3b5aa765d61d8327deb882cf99:password
✓ MD5 hash cracked in < 1 second
✓ "password" is a common password
✓ No salt = identical passwords have same hash
✓ Entire database can be cracked quickly