Progressively get rid of MD5

[bloatware]

Is your feature request related to a problem?

Potentially.

What is the feature?

We currently use MD5 for all sort of hashes, both cryptographic and not. But

• MD5 is not very reliable as crypto hash and could be replaced by Tiger-128, which is slightly faster too.
• PHP8 implements XXH algo for non-crypto hashes, which is way faster.

The only drawback of replacing MD5 seems to be that we use it also in some db queries, but this is not essential.

Thoughts?

[Bloke]

I'm all for migrating. We do need to harden the login session cookies anyway because it's a bit old hat. Since the move to a better algorithm will invalidate login cookies when we get to the md5s used there, it makes sense to do both at the same time to minimise disruption.

[bloatware]

Yep, 4.9 is probably a good moment to do it, since we tighten the security here and there. The public cookie is especially weak. Tokens are concerned too.