Bcrypt and scrypt don't suck. Only use PBKDF2 if you are comfortable with a function that a GPU-using attacker can evaluate many hundreds of times more efficie

Bcrypt and scrypt don't suck. Only use PBKDF2 if you are comfortable with a function that a GPU-using attacker can evaluate many hundreds of times more efficiently (in terms of energy cost) using hardware that hundreds of times cheaper (in terms of $/guess/s). Expressed in terms of log base 2, by using PBKDF2 you're leaving several bits of security on the table. And most folks agree that passwords need all the effective entropy they can keep.