4 ms·
1000 is a very low number for PBKDF2 iterations. OWASP recommends 10 000, and also recommends using Argon2 instead. Apple does 10 million.
by erikbye 8y ago
1000 is a very low number for PBKDF2 iterations. OWASP recommends 10 000, and also recommends using Argon2 instead. Apple does 10 million.
- rocqua 8y agoThey have an open bug to change the number of iterations. Also, there are more rounds server side, so at least the values in a database are pretty safe in case of a leak.