My hashed/unhashed comparison was not a performance statement, but a trust statement. If a breach will lose the same amount of confidence regardless of password storage, why bother with even hashing?
I can't imagine how "good security - scalable enough for Twitter" can be a hard sell. Your customers certainly won't by sympathetic if they learn that you willfully chose weaker security to save a buck.
I can't imagine how "good security - scalable enough for Twitter" can be a hard sell. Your customers certainly won't by sympathetic if they learn that you willfully chose weaker security to save a buck.