This is a blog post responding to another blog post.  The first one recommended using HMAC in a place where it is totally appropriate to use HMAC.  The response seems to miss that point.<p>To store passwords in a database the 'proper hash' to use is openbsd's bcrypt. <a href="http://www.openbsd.org/papers/bcrypt-paper.ps" rel="nofollow">http://www.openbsd.org/papers/bcrypt-paper.ps</a>