To be fair though, all security is about obscurity. The questions is just how obscure. One could certainly argue that using bcrypt instead of SHA-1 without salting is a lot more important than not disclosing your security practices but they are not mutually exclusive.