Certainly would, although SHA1 is being phased out, it's probably still "ok" to use, but I wouldn't choose it if I wanted the project to achieve maximum longevity, I'd choose a later family of SHA, SHA2. It will be slower, but you won't end up looking like gawker. Since node just uses openssl you have quite a collection of message digest algorithms to choose from. Run an "openssl speed" on your server to get a benchmark of different algorithms.

Edit:

    type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes

    md5              24629.04k    83750.79k   226739.03k   391874.18k   509285.72k

    sha1             24185.38k    75777.49k   177806.76k   263012.01k   305498.58k

    sha256           17504.41k    42089.29k    84845.06k   108628.53k   120801.96k

    sha512           13258.86k    57601.03k   101861.29k   155866.45k   188783.13k

Also, you're using iterating 1000 times for all users, you can mix it up and store that with the user in mongo. (1000-1000+). You might also want to serve up your login and any pages requiring some form of authorised behaviours using https. (Prevent auth token theft and password sniffing).

Also when validating user input for passwords, are you sure it's isAlphanumeric() that you want? Some users like to have non alphanumeric characters in their passwords. If it's just an attempt to stop xss/injection then I believe node-validator supports that without restricting you to alphanumeric characters only.

You might also consider bcrypt. See:

http://news.ycombinator.com/item?id=762708

For a discussion on it.

I think the general consensus post Gawker hacking was that hashing alone was inadequate and that for greater security you should use bcrypt as it takes so much longer to run attacks.