Stefan_H

Doing a column in the database is exactly what I suggested... Also, saying that anything is "very unlikely to need replacing" is extremely short sighted of you. And the point is not to necessarily do it "in a hurry" but rather to identify a mechanism for doing it at all, in a way that doesn't require resetting every user's password.

This article left out one important item, in my opinion. You should also have a way of changing what algorithm is used in doing the hashing on the fly. Perhaps a "HashVersion" column so that you can easily migrate users from an older (possibly broken) algorithm, to a newer one as soon as they log in again.

The west coast loves avocados as well. They are the fruit of life. California produces about 90% of the nation's avocado crop. http://www.avocado.org/fun-avocado-facts/

Please note that there was no analogy in my original comment. I was merely summing up the OP's argument. Additionally, as someone who has plans to write a craigslist-centric app, and took the time to read the TOS, I find it idiotic for a developer to charge ahead with creating an app/site without either understanding the terms, or obeying them.

What's more is that you are arguing against the notion that whoever creates the content (or own's the content) has the right to decide what gets done with that content. And no matter how much you dislike what they are doing with their content (ie. not creating a shiny interface to access said content), that does NOT give you the right to use that content without permission. It is my understanding that craigslist often gives out permissions to use it's content, and it would appear as though this company didn't bother to secure that permission.

So your argument is "Since they are not doing everything they can with their content, I can steal it"?

It seems that some people use it to represent something that you can have traction on, like for dragable items (the slide to open camera on the iphone lock screen and the dragable reording from the writer's example).

However any salting tactic that can be pushed and used on the client side would have a tough time using a salt that is on a per-user basis. This means that if you could salt it client side, you would need to have a static salt, which is significantly less secure than a unique salt per user.