title: Why is MD5'ing a UUID not a good idea?
body: <p>PHP has a <a href="http://us2.php.net/manual/en/function.uniqid.php" rel="noreferrer">uniqid()</a> function which generates a UUID of sorts.</p>
  
  <p>In the usage examples, it shows the following:</p>
  
  <p><code>$token = md5(uniqid());</code></p>
  
  <p>But in the comments, <a href="http://us2.php.net/manual/en/function.uniqid.php#91126" rel="noreferrer">someone says this</a>:</p>
  
  <blockquote>
    <p>Generating an MD5 from a unique ID is
    naive and reduces much of the value of
    unique IDs, as well as providing
    significant (attackable) stricture on
    the MD5 domain.  That's a deeply
    broken thing to do.  The correct
    approach is to use the unique ID on
    its own; it's already geared for
    non-collision.</p>
  </blockquote>
  
  <p>Why is this true, if so? If an MD5 hash is (almost) unique for a unique ID, then what is wrong from md5'ing a uniqid?</p>