Which hash algorithm is considered DEPRECATED / WEAK and should NOT be used for new applications?

1. MD5: PRACTICAL COLLISION ATTACKS exist since 2005 (Wang et al.). Two different inputs can be made to produce the same MD5 hash. Broken for security purposes. 2. SHA-1: also broken — Google demonstrated a practical collision in 2017 (SHAttered attack). 3. MODERN choices: SHA-256, SHA-3, BLAKE2, BLAKE3. 4. MD5 is still acceptable for NON-SECURITY uses (checksums against accidental corruption), but never for signatures, password hashing, or integrity verification against adversaries. 5. Options A, B, C are all considered secure. _Source: Boneh & Shoup, §8 (Hash functions) + NIST FIPS 180-4._