Jeff regularly "drops the ball" on most things. He blogs about what he is learning about, and not what he has mastered.

Remember him getting his knickers in a twist over AES ECB? Or more recently conflating secure hashes with hashes for other purposes? Or back-peddling on, well, everything?!

I love his writing and read every blog entry. But I shudder if we hold him up as an expert in recommending how to secure passwords and such!