Good post but talking about hash functions being broken when your authentication system is a password is basically rearranging the deckchairs on the titanic. Passwords are broken much, much worse than MD5 is broken. Anybody with data to protect that thinks they can't tolerate the compromise of a password, probably shouldn't be using a password. Any user relying on a password should assume it will be compromised and be ready to change it.