Why MD5 and SHA-1 Are Considered "Broken"
MD5 and SHA-1 are considered cryptographically broken because researchers have demonstrated practical methods to deliberately create two different inputs that produce the identical hash (a collision) — MD5 collisions were first demonstrated in 2004, and a full, practical SHA-1 collision was publicly demonstrated by Google and CWI Amsterdam in 2017 (known as the "SHATTERED" attack) — meaning both algorithms can no longer be trusted for security purposes like digital signatures, even though they remain fine for non-security uses like basic file-corruption checksums.
This is a real, well-documented part of cryptographic history, not a theoretical or exaggerated concern.
What a collision attack actually breaks
If an attacker can construct two different files or messages that hash to the same value, they can potentially substitute a malicious file for a legitimate one while producing an identical hash — defeating the entire purpose of using a hash to verify authenticity or detect tampering, which is why any security-relevant hashing needs an algorithm collisions haven't been demonstrated on.
Why they're still around despite being broken
MD5 and SHA-1 remain fast to compute and are still embedded in many older systems and legacy protocols, and for a non-security use — like a quick checksum to catch accidental file corruption or verify a download completed correctly — a collision attack isn't a realistic concern, since nobody's deliberately trying to construct a colliding file in that context.