incidentally though i ve not had passwords stolen from custom-built authentications (that were not as strong as u say), but i did from cms systems that are common and thus have tons of bots attacking them (e.g. wordpress). Security through obscurity should be added to off-the-shelf auth libraries i guess