His advice is good, but that's still no excuse for making invalid arguments for what he is advocating.
Edit: In fact, if I hadn't heard of bcrypt before and saw that article, I would probably not trust his advice either.
Edit: In fact, if I hadn't heard of bcrypt before and saw that article, I would probably not trust his advice either.
So that post may be incomplete regarding the technical details, but the critical information is there: Just use bcrypt. (...and use the recommended work factor.) I know hackers hate that sort of thing, but this is really one of those things we just have to drill.