> The best practice is that password data should be stored as a salted hash, so if the database is compromised, the original password can't be retrieved.
The best practice is to use a purpose-built password algorithm like bcrypt. Algorithms like SHA1 and MD5 are designed to run fast; even with salts they can be cracked by massively parallel hardware like a room full of GPUz.
The best practice is to use a purpose-built password algorithm like bcrypt. Algorithms like SHA1 and MD5 are designed to run fast; even with salts they can be cracked by massively parallel hardware like a room full of GPUz.