Earlier quoted context omitted.
> MD5() isn't a primitive, it is an entire > implementation. No, it's a primitive. From https://en.wikipedia.org/wiki/Cryptographic_primitive : Commonly used primitives One-way hash function, sometimes also called as one-way compression function—compute a reduced hash value for a message (e.g., SHA-256) Furthermore: Cryptographic primitives are one of the building block of every crypto system, e.g., TLS, SSL, SSH, et…
It is in the context of building a larger cryptographic protocol. But they aren't building a cryptographic protocol in this case, so none of that applies here at all, even a tiny bit. In this case hashing functions are being used stand alone (both bcrypt and MD5), and therefore they're not cryptographic primitives. The only time they become cryptographic primitives is when they're used as such, in a cryptographic pro…
They tried to implement a "secure login token" by leaking the user credentials in quasi-plain text (with the advent of rainbow tables then GPUs, MD5 is barely better than Rot13 nowadays).
But still, there's math in that. Strings form a monoid under concatenation and toLowerCase() is a pure function (probably 'map (_ $ 223) source' for a given subset of the domain).
To keep with your (insulting) analogy, they tried to build a car by pouring mayonaise on a crankshaft when they really needed a trumpet.
By doing so, they ruined the protection offered by their otherwise strong password hash.
Don't roll your own crypto. Also, assuming your interlocutor has a modicum of intelligence is basic courtesy.