If you can tell that they are using the same password, best practice says you're doing it wrong. At least, so I've been led to believe. Per-user salt is still

If you can tell that they are using the same password, best practice says you're doing it wrong. At least, so I've been led to believe. Per-user salt is still recommended, isn't it?