The title doesn't inspire confidence in the rest of the piece. Why is it that increasingly, people feel compelled to put such a negative spin on content. Another "if you don't do <something I feel strongly about>, you are <something negative>" piece. If what you are writing needs some clickbaity title, I'm not interested.
I have not heard of peppering before, and if the author would have titled something along the lines of "peppering significantly improves the security of your stored passwords" I would have been all over it. Now the author has already called me "irresponsible", and he doesn't even know me. Well, fuck that guy, I'll find somewhere else to read about what specific seasoning I should be applying to stored passwords. What an ass.
EDIT He just changed the title.
This is not how HN works.
"You should not be using Bcrypt. You should be using passphrases."
These seem orthogonal to each other. How would you store the 'passphrases'? in plaintext? or hashed? if hashed, what hashing algorithm? Why not bcrypted passphrases?
Passphrases give us the ability to easily remember high entropy password values.
Passphrases are not high entropy once you take into account that they're words in a specific language.
If you genuinely do
grep "^[a-z]*$" /usr/share/dict/words|shuf -n 4
Pick them from your own day to day vocab and you're more likely in the 2^32 range.
tptacek in 2016 on peppers: https://news.ycombinator.com/item?id=12550375
The current best practice of simply hashing passwords with bcrypt is fine, and anything past that which doesn't doesn't involve (probably per-password) use of an HSM adds only marginal value.
I wouldn't want anyone to read this and get the impression that "secret peppers" and multiple hashing rounds and HMAC were important components of a password storage system. They are not: they're things that message board nerds come up with.
If you want to be a step better than just storing passwords with bcrypt, your next step is to create an authentication service that runs on separate hardware with an "is this password valid" and "enroll this password" API and nothing else. The stuff people do instead of this is basically cosmetic.