One thing I learned some years ago is to always avoid being the agent for someone else's humiliation. Even if that person is blatantly wrong, all you'll do by calling them on it is create an enemy.

One trick I've used many times to correct someone without embarrassing them is to couch my own feedback in conditionals, something like "You've been studying this a lot more than I and I'm sure you're probably right but I seem to recall reading a bit ago that an md5 sum isn't a sufficient way to hash a password, you need to do more processing."

That then gives them an out "yeah I looked into that and I'm pretty sure this is best practice but I'll check again" or somesuch. Probably 80 percent of the time, when I frame it like that, I'll see a followup saying that they've gone back and discovered the right way and will be doing it that way.

The really nice thing is that people are appreciative when you treat them that way, and far from creating a new enemy you'll have earned respect and trust from that person.