> We use your typical web app SHA1 hash with generated salt.

Oh, no! casts summon tptacek

Actually, in his absence, I'll link to this recent topic on HN: http://news.ycombinator.com/item?id=2004833

This is particularly relevant given the recent complete and utter ownage of Gawker and friends. Had they been using SHA1 (whether or not they had a fancy, home-grown salting/obscurity system to use with it) instead of DES, the result would have been basically the same.

tl; dr: SHA1 is FAST. Do NOT use it. Use bcrypt. Please.