[atmanactive]

Ah yes, thanks for the clarification. So, two mishaps are needed for this to work: a site needs to be hacked and the user database stolen, and, a person needs to use the same user/password for all sites. Takeaway: never use the same password twice. Got it.

[matthewmacleod]

AND that site has to be using unsalted MD5 password hashes, in which case you were already doomed

[ranger_danger]

Salts do not make brute-forcing any more "difficult" though if that's the method you're using to crack with.

[matthewmacleod]

Of course this is correct (merely makes it so that you have to brute force instead of look up in your book)!