Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Ideally the md5 library documentation says "this is a digest function, not a secure bash"


Those words might as well be in greek.

How about:

You should use the md5 function to produce a string you can compare with the md5 function.

md5 is obsolete, does not offer much security, and should not be used in new programs except for the purposes of interoperating with old programs, and even in that case, one should weigh the risks of interoperation with the costs of replacing.

If you are looking for a suitable replacement for md5, you should instead be looking for specific use-cases, such as content verification (links...), authenticated content verification (links...), password verification (links...), random number generation (links...), shared secret encryption (links...)


In fact you only want to use it when your comparison can afford collisions (md5 generates a lot of collisions). Sha256 is pretty much collision free.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: