Should websites be required to publicly disclose password storage strategies?

He's right that this at least better than the "we use cookies" notice.

No. I think we should keep the "required to" list as short as possible, in general.