I agree totally, this is an area where frameworks should shine. I really like the approach Django 1.4 is taking. They have a new default hashing algorithm: PBK

I agree totally, this is an area where frameworks should shine. I really like the approach Django 1.4 is taking. They have a new default hashing algorithm: PBKDF2, but they've also made it easy to choose your own. You can upgrade hashers at any time by changing the order of the PASSWORD_HASHERS setting, every password will be upgraded on a successful login. Using bcrypt is as simple as installing py-crypt and changing the top choice in the PASSWORD_HASHERS setting. Increasing the work factor for the hashing algorithm is also really easy to do so: create a subclass of the hashing algorithm you want to upgrade, set the multiple you want to increase the iterations by (say 100 times more), then add your subclass to the PASSWORD_HASHERS setting. Like you said, it is more work to implement cleartext passwords. Going back to the OP, when it comes to: "easier for us to pose as a user to duplicate problems" I'd say that in cases where you need to access a user's account, it's probably better to allow superusers or staff to "login as user" using a different mechanism than the normal password login/authentication.