I've been saying "scrypt, bcrypt, PBKDF2, or bust" for years. Also, there's a large industry trend of, "let's 'pepper' our hashes too!" whereby they have a sit

I've been saying "scrypt, bcrypt, PBKDF2, or bust" for years. Also, there's a large industry trend of, "let's 'pepper' our hashes too!" whereby they have a sitewide salt. This is a mistake. If you want to add a site-specific layer of security to your passwords, encrypting them makes far better sense than adding to the salt. https://github.com/lizardhq/php_bcrypt_aes https://github.com/lizardhq/php_bcrypt_aes http://blog.ircmaxell.com/2015/03/security-issue-combining-bcrypt-with.html http://blog.ircmaxell.com/2015/03/security-issue-combining-b...