So: "just use bcrypt" should really be "just use a pluggable key derivation function". Then plug in something suitable. bcrypt is a start, but you might also co

So: "just use bcrypt" should really be "just use a pluggable key derivation function". Then plug in something suitable. bcrypt is a start, but you might also consider PBKDF2 or scrypt.