> Given the age and limited computational "strength" of crypt-DES, however, this is no longer true; brute-force computation of crypt() passwords is easily done. Programmers are encouraged to use more modern hashing and encryption algorithms, such as SHA1 and Blowfish
Seriously? This is bad advice! While crypt-DES is indeed old and should be deprecated, it is a proper salted password hashing function.
SHA-1 is NOT a replacement for crypt-DES at all -- it's a hash designed to be fast and it defines no salting mechanism. Thus, all passwords in a compromised database can be checked in parallel and cracking can be very fast using precomputed (publicly available) rainbow tables; yet it's faster than crypt-DES even in the brute force case. Worse, it's vulnerable to collision attacks, which makes it unsuitable for some applications, so it shouldn't be recommended at all for anything new.
PBKDF2 is *the* standard for password hashing. It defines a variable iteration count and salting, with some other nice properties. Or if you're feeling adventurous, scrypt is interesting.
And Blowfish... It's even further from a crypt-DES replacement. It has no known vulnerabilities, but even its designers recommend using AES instead.