I'm more or less saying that `getattr` may be an unintentional good thing, as we're subject to the built in versions of the primary hashlib algorithms, rather than arbitrary hashing algorithms bundled with openssl. OpenSSL includes at least one hashing algorithm (md4) with [known derivable collision attacks](http://en.wikipedia.org/wiki/MD4#Collision_attacks). Demo:

```python
In [76]: k1 = binascii.unhexlify("839c7a4d7a92cb5678a5d5b9eea5a7573c8a74deb366c3dc20a083b69f5d2a3bb3719dc69891e9f95e809fd7e8b23ba6318edd45e51fe39708bf9427e9c3e8b9")

In [77]: k2 = binascii.unhexlify("839c7a4d7a92cbd678a5d529eea5a7573c8a74deb366c3dc20a083b69f5d2a3bb3719dc69891e9f95e809fd7e8b23ba6318edc45e51fe39708bf9427e9c3e8b9")

In [78]: k1 == k2
Out[78]: False

In [79]: hash1 = hashlib.new('md4'); hash1.update(k1)

In [80]: hash2 = hashlib.new('md4'); hash2.update(k2)

In [81]: hash1.digest() == hash2.digest()
Out[81]: True
```

Is this a reasonable means of attack? No. You would have to construct a very well structured notebook, chunking away at partial bytes. This is mitigated by not allowing an attacker to "pick" a weaker algorithm.