For web app passwords, brute force attacks against salted hash files are going to compromise so many passwords that the net effect to your business is going to be bad.<p>With bcrypted or even PBKDF'd passwords, you'll at least have a plausible response to a compromise, and some certainty that hundreds of your users passwords aren't going to be posted to a web page.