I just don't get why we keep seeing stories like this? PBKDF2. If you can roll your own code to stupidly hash passwords unsalted using MD5 you could in less time just implement PBKDF2 and be secure ...