> We use your typical web app SHA1 hash with generated salt. Oh, no! casts summon tptacek Actually, in his absence, I'll link to this recent topic on HN: http

> We use your typical web app SHA1 hash with generated salt. Oh, no! casts summon tptacek Actually, in his absence, I'll link to this recent topic on HN: http://news.ycombinator.com/item?id=2004833 http://news.ycombinator.com/item?id=2004833 This is particularly relevant given the recent complete and utter ownage of Gawker and friends. Had they been using SHA1 (whether or not they had a fancy, home-grown salting/obscurity system to use with it) instead of DES, the result would have been basically the same. tl; dr: SHA1 is FAST. Do NOT use it. Use bcrypt. Please.