[rgbrenner]

it appeared after sha1, receives less attention than sha1, and is slower than sha1... so why use it at all?

[thirsteh]

Many use it because it wasn't developed by the NSA. It is a default in TrueCrypt, for example.

[nly]

It's used in Bitcoin as well (after SHA-2) to shorten up addresses. Come to think of it, I think Tor uses it for .onion addresses... which they shorten to 80 bits (of preimage resistance!)