This is a great series of posts! a must read for every developer. If anyone is wondering about the practical aspect of it, here is my interpretation: never use

This is a great series of posts! a must read for every developer. If anyone is wondering about the practical aspect of it, here is my interpretation: never use MD5, SHA-1 etc to hash passwords, they are too fast, anyone with a good GPU / dedicated hashing hardware can brute force short common passwords quickly (Carla), use bcrypt/scrypt or at least SHA-256 with many iterations, and increase it every couple of years as hardware get's faster... I would also add: salt your passwords with a secure random, and force strong long passwords, don't have "security questions" (they can be Googled / facebook graph searched easily), respond the same time for correct or incorrect credentials to avoid timing attacks, and note that whatever you do, if someone got their email account compromised, none of this will matter. Thanks again for a very well explained set of posts, hope it will make our web a bit more secure...