One thing the paper does not seem to cover is the loss/increase of entropy during various programmatic transformations. For eg: one-way hash functions, make the original data irrecoverable, but encryption does not (unless it is end-to-end). So, it might be okay to store passwords in hashed form, but not encrypted form. Ideally, program analysis should help surface such bugs.