Since our own tptacek hasn't shown up, I'm going to link to (the only copy I can find of) one of his great blog posts on this subject: http://www.securityfocus

Since our own tptacek hasn't shown up, I'm going to link to (the only copy I can find of) one of his great blog posts on this subject: http://www.securityfocus.com/blogs/262 http://www.securityfocus.com/blogs/262 To quote, emphasis his: Using raw hash functions to authenticate passwords is as naive as using unsalted hash functions. Don’t.