It seems it started a flamewar about sha1 and bcrypt.

First: scrypt (http://www.tarsnap.com/scrypt/) is far better than bcrypt.

Second here is the general idea behind the scrypt algorithm (from the scrypt slides):

Algorithm ROMix:

    Given 
    a hash function H, 
    an input B (the user password), 
    and an integer parameter N (computational hardness), 
    compute:

 V_i =H^i(B) (0 <= i < N) and X = H^N(B), then iterate

        j ← Integerify(X ) mod N 
        X ← H (X ⊕ Vj )

    N times; and output X.

The function Integerify can be any bijection from {0, 1}^k to {0...2^k −1}.

Theorem:

Under the random oracle model, the class of functions ROMix are sequential memory-hard.

More intuitively,

    V_0 = H(B)
    V_1 = H(H(B))
    ...
    X = V_N = H(H( ... H(B) ...) )

V_i are filled with pseudo random values.

Then the algorithm access them in pseudo random order.

Which means that is is not only very long to compute but also need a lot of memory.

Now zealot should say _use scrypt_! not bcrypt. And also, even if cryptography is difficult, the idea behind is not so difficult.