Implementing OAuth to avoid picking a password hash is a crazy security tradeoff.<p>This is the kind of thing that made me feel like the Password Hashing Contest might be a net negative for systems security. In reality, despite what this blog post says, you could select the worst of the password hashes --- PBKDF2 --- in relatively weak parameters, and still be fine.<p>If you give nerds 3-4 things that do the same thing, we will find 10^(3-4) different ways to have arguments about them.