crypto101 says that because of how fast GPUs are at computing hashes, even using long per-user salt is now broken and you must use pbkdf2 or better yet, scrypt.