But now I'm curious: the author states that neither scrypt or PBKDF2 are really designed for password storage. Can anyone explain how a construction designed for this purpose would differ?
Edit: I get that one of the goals for a KDF is to securely hash/expand a short input (password) of N bits out to something potentially >> N bits; and in the case of scrypt, do it in a way that's expensive for bruteforcers but acceptable for authentication.
Is the reason scrypt/PBKDF2 aren't for password "storage" simply because they're not usable as such OOB (missing salt handling which bcrypt gives you for free?)