[_b8r0]

Are you saying that we should ignore rainbow tables? I appreciate that you know way more about crypto than I do, but I think you're working from the standpoint that people know how to do things the right way, as opposed to the real world situation where people very clearly don't (e.g. NTLM, Oracle being 'Unbreakable', iPhone screen lock security mechanisms).

For as long as there's people using unsalted MD5 hashes in their PHP applications, Rainbow Tables are a real threat.

[tptacek]

Yes. I think you should ignore rainbow tables. People using salted MD5 hashes in their PHP applications are also creating a real threat.