I agree with you, in particular about the "password storage" stuff. OWASP has a particularly poor history of engaging with cryptography, and, because (I think) of the personalities involved, tend towards a "teach the controversy" approach anytime they're corrected.
Obviously OWASP can't be perfect. We may see the same security issues over and over but the details of particular problems will be specific to the code-base.
But stuff that is universal should be a lot better. Broken Auth page is so horrendous. They mention Broken-Auth then link to a 404 Session Management page, a white-paper on Session fixation, and a paper on password recovery.
It's bad. Instead of being a wikipedia where people can look up types of vulnerabilities, OWASP should try to have more pseudo-code or real code that developers can reference. They have some of this already but they need more
