[roel_v]

"you have to assume someone who stole your database also stole your code."

Maybe, but that doesn't mean that a separate salt, not in the database, will prevent certain attacks, and as such is a viable option. Security is about layering, not about 'xyz isn't 100% secure in 100% of the cases, forget about it'.

[owenmarshall]

That's fair, but it doesn't change the insanely wrong statement that triggered this comment chain:

"sha1 with a salt u cant find beats bcrypt with a key u know any day"

This is fractally wrong.

[roel_v]

OK then we agree there :)