Someone pointed to me this pretty good article about password hashing and HMAC. I must admit that before reading the article, I was barely familiar with HMAC. I am, however, familiar enough with one-way hash functions to comment a bit on the article, and since I feel there are incorrect conclusions in this article, I also feel I should try to correct those.