My email is firstname@companyname.co.nz (I have a few of these at different companies). I'm fairly confident this isn't going to be cracked any time soon by random MD5 hashing.
(of course, my real name can be extrapolated from my HN username)
(of course, my real name can be extrapolated from my HN username)
Your call on whether "An adversary can only defeat my security given three hours and a hardware investment of $1,600 2010 dollars" is an acceptable security bound for your users. If it isn't, don't use MD5 for crypto purposes.
Still, I don't think I've ever had a rainbow table that contained plaintexts longer than 12 characters. Are 30+ length tables common these days?
You’re correct that brute force with an entropy of 3 per bit would still be too big for rainbow table usage (like 10^15 PB too big).