Just as a random question: Why are people using hash functions designed to be fast for large file digests/etc (ie. SHA) for password hashing?
Isn't this what scrypt/bcrypt/etc. are designed for?
Isn't this what scrypt/bcrypt/etc. are designed for?
Also when much of this started we didn't have hardware that could brute and entire database of hashes within hours.
Lastly, laziness.