The constructor for the Python HMAC library just defaults to MD5; you can pass any of the hashlib modules to it via the digestmod parameter. I don't know why it doesn't default to something more secure, but it's no challenge to do.