Is MD5 broken or not, can be understood by the issue of password hashing and use of rainbow tables is down to the security of a web server being exploited through an underlying weakness. First up are all these websites purporting to offer a simple test to see if your password is secure... Ummm well let's look at these sites as phishing and all people rolling up to these sites are doing is feeding a rainbow table. That is one part of the problem.
Second up are people who use web hosting services where the object is to rake in money and forget about web server security, these hosts should be put up against the wall and shot IMHO, part of the security of a users login comes from the security of a web server and the underlying technologies being up to date to stop known exploits from being used.
Third up is that once people get in to their thick heads that while MD5 is not collision resistant or I prefer as robust as it could be, it is still difficult for a users account to be hacked unless you have a web host running an exploitable system, your web coding is not robust and you expose yourself by using a site claiming to check your password security.
For the large part MD5 + a Salt value is adequate security for a user login on a web forum as long as the previously mentioned system and software is not exploitable. Once you have a system that has been exploited for a weakness, running a query for known hash values which don't use a salting system will expose a fourth weakness... the end user.
Fourth up is the end user, your web security is ultimately only as strong as the weakest link and for many they will see the end user as just that and admins need to remember that they are end users of a system and are equally as vulnerable to compromising a systems security by employing sloppy programming or software that is easily broken, poor password security and also failing to change that ADMIN login or using software that today still insists on having the admin login name as Admin and also employing super user accounts. So it goes without saying, so I will say it anyway, MD5 is not cracked, it is reverse engineered through weak users, weak software and people's inability to understand a technology. If MD5 is cracked, so is SHA and AES and so on...
