One concern I have here, is that people are going to perceive this post as "this is what you should do and it's easy!", because the post doesn't really address

One concern I have here, is that people are going to perceive this post as "this is what you should do and it's easy!", because the post doesn't really address the complexities of implementing this kind of thing. As a result, we're probably going to have a bunch more issues like this one: http://blog.ircmaxell.com/2015/03/security-issue-combining-bcrypt-with.html http://blog.ircmaxell.com/2015/03/security-issue-combining-b... I'm not looking forward to having to talk people off that particular ledge for the next several months...