[bonzoesc]

Because sha1 is still super fast on a GPU. Why aren't you using bcrypt?

[Misiek]

I thought that hashing password with two types of salt (one of them is unique for every user) and two places to storage salts is secure enough.

[tptacek]

You thought wrong.

[bonzoesc]

Salts don't slow a GPU down: http://codahale.com/how-to-safely-store-a-password/