But he is hashing secrets. Salted and Hashed passwords are extremely important...and saying "Don't Hash Secrets" is just an attempt to get him more traffic. Th

But he is hashing secrets. Salted and Hashed passwords are extremely important...and saying "Don't Hash Secrets" is just an attempt to get him more traffic. There is another important aspect to salting that he neglects to say. Adding an 8byte salt is extremely effective (along with a proper password hashing algorithm) in increasing the complexity of generating and storing rainbow tables. PBKDF2 and bcrypt are both slow enough to protect a lot of that low hanging fruit that he is saying ISN'T protected....Sure if you use SHA1....they might get some of them....but everyone agrees you should not be using SHA1 ! (for passwords).