Don't use bcrypt
<i>> I write this post because I've noticed a sort of "JUST USE BCRYPT" cargo cult... This is absolutely the wrong attitude to have about cryptography.</i><p>No. This is incorrect. This is exactly the <i>right</i> attitude for most developers to have about cryptography, because on a subject as complex as cryptography most developers (including me!) are <i>nowhere near smart enough</i> to understand the ins and outs.<p>Encouraging people to make their own decisions on subjects they aren't equipped to understand fully is dangerous advice. It leads to all sorts of bad outcomes. People who have to choose between options they don't really understand end up choosing things at random, or on the basis of incomplete or misleading information, or getting seized up by the need to make a choice and choosing nothing at all.<p>This makes cryptography one of the <i>very few</i> cases where a cargo-cult approach is better than the alternatives. A simple message that "this is the approach people smarter than you agree is correct, use it," repeated consistently, will help more people more completely than dumping them into the deep end of the crypto pool ever will.