Hey there. My name's Chris and I post a bit to the off-road forum. Maybe Tim can vouch for me. This is a good topic. I have a few things to add.
I drove a car in bare metal for two years. Even in southern california it was a constant battle (and yes, I oiled the car regularly). Here are a few things I learned.
like phosphoric acid. As ray said it's the main component in ospho. It's also the primary component in automotive metal prep. It works a bit slower than muriatic (30%HCL), but it's considerably more friendly to use (it won't immediately burn you if you get splashed and you won't burn your eyes or lungs unless you really get down on top of the stuff). Kleen Strip offers it in gallon sizes. The last time I bought some at the Great Orange Mecca it was $13. It will not cause that residual flash rusting as muriatic will. Use a red Scotch-Brite pad and it'll cut through even nasty stuff. At the same time, I'd limit its use to removing heavy surface rust. You can also dip your hardware in it and it'll come out sparkly. Water is good enough to neutralize the effects of the phosphoric acid.
Kleen Strip also makes an automotive metal prep that's a bit more aggressive than the straight phosphoric. It also has zinc phosphate in it, which leaves a streaky white film on the bare metal that prevents rust from setting in for quite a while. The major paint companies have similar products, but for some reason they ain't as strong. Again, water will neutralize it.
To keep flash rusting at bay after I cleaned everything, I'd wipe it all down with automatic transmission fluid. Use Mercon if you're a Ford fan; Dexron if you like every other car in the world that has an automatic
. Whatever you use, make sure it has no silicone in it. That will wreck a surface that you intend to paint. Contrary to popular belief, WD-40 is perfectly safe to use on any surface that will be painted. It has no silicone. I used WD at first, but it gets sticky fast and turns things into dirty, bearded stuff. The ATF is clean. In fact, it cleans the metal pretty well.
Now for muriatic. I've sloshed it on and dipped things in it. It works like magic...too well if you're not careful. It'll render a stamped part to lace in hours. I'm a crazy bastard and I use it full strength (muriatic is only 30% HCL; the rest is just water for a buffer). I dip a lot of hardware into the stuff with great results.
I hated the flash-rust problem so I'm one who neutralizes. I use sodium carbonate (wash soda) NOT sodium BIcarbonate (baking soda). I get it at pool supply stores. Look for something that increases the PH (PH UP! for one). You can probably find it pretty close to the muriatic if you buy it at a pool shop.
I mix a handful or two into a gallon pail and paint the stuff on or drop hardware in it. Even though I keep my acids well away from the sodium carbonate solution out of sheer principles, I've poured small amounts of acid into the sodium carbonate solution without catastrophic results. It just foams up and turns green. I'm sure it's on account that the solution is so weak that it's more of a buffer than anything. I'm sure mixing muriatic with a very high PH compound like bleach would be awful, if not fatal. Don't do it.
Whatever you do, wear a full face shield, respirator, rubber gauntlet gloves, long-sleeve shirt and long pants, and closed-toe shoes when working with any of this stuff. Chemical burns are NASTY. It's not so critical with the phosphoric, but it's imperative with the muriatic. You will remember every little mishap you have with muriatic, all the way down to etching the concrete accidentally.
I'm also a really big fan of the electrolytic rust conversion. I've done a fair bit. I lined a five-gallon pail with half a dozen strips of 1/8x3/4 strap for my anode (it's a line-of-site operation, so the more you have the better). It goes without saying that I use a plastic bucket, but I thought I'd bring it up nonetheless. My anodes bolt to the rim of the bucket and go to the bottom. I connect them with plain copper wire outside the bucket. Just make sure that your part to be derusted doesn't touch the anode(s). Use an ammeter to make sure that the current flow doesn't get too high. Some battery chargers have them. I've used the 10-amp current on my charger but I keep the actual current in the lower digits. Sodium carbonate concentration, number of anodes, distance from the anode(s) to the part, and part size itself will influence current flow. Oh yeah, you want to use the sodium carbonate (wash soda), NOT the sodium BIcarbonate (baking soda) for your solution. A few tablespoons to a couple gallons is enough. A stronger solution will not necessarily work better.
A few things to know about electrolytic rust conversion: it releases hydrogen. That's what made the Hindenburg go BOOM (oh the humanity!). It's not much, but you don't want to do it in a sealed, confined space and light a crack pipe, but that goes without saying too. When I do it, I just make sure to crack the garage door and window open so I get good circulation. Also, as long as you don't have oil or any other foreign substance in your de-rusting pail, the stuff is safe to dump. It's just sodium carbonate and a bunch of ferric oxide. It might even make your lawn nicer if you have low-PH soil.