No it isn&#x27;t.<p>That is a login routine&#x2F;authentication. If they had replaced MD5&#x2F;bcrypt with their own in-house alternative, that would be rolling their own &quot;encryption&quot; (hash function). But as is, they designed a login&#x2F;authentication scheme that was highly flawed, but used off-the-shelf hash functions to do so (even if MD5 is deprecated at this point for anything security related).<p>To phase this simply: &quot;If they didn&#x27;t do maths, they didn&#x27;t design their own encryption scheme.&quot; They did not, so therefore they did not.<p>Now you can argue the merits of using an off-the-shelf authentication&#x2F;login scheme (e.g. Kerberos, OpenID, ASP.net&#x27;s authentication provider, etc) and I would agree. But that isn&#x27;t what you said, you specifically said they rolled their own &quot;encryption&quot; which they did not.