I believe that SHA-1 was solved in faster time than brute force in early 2005
You can read more about this in Bruce Schneier blog (he is a well-known cryptanalyst) at: http://www.schneier.com/blog/archives/2005/02/sha1_broken.html http://www.schneier.com/blog/archives/2005/02/cryptanalysis_o.html Basically new applications should use stronger versions of SHA such as SHA256 which seems to be part of the .NET framework: http://msdn.microsoft.com/library/default.asp?url=/library/en-us/cpref/html/frlrfsystemsecuritycryptographysha256classtopic.asp among others. Security is a tradeoff so it could make sense in some applications to still use SHA-1 but since better hashing functions are available and have the same interface, sha-1 should certainly not be use by default.