3 ms·
A way to think about the difference you just made is, you increased the difficulty of cracking your password by 600000 / 5000 = 120. Making your attacker guess
by rstuart4133 4y ago
A way to think about the difference you just made is, you increased the difficulty of cracking your password by 600000 / 5000 = 120. Making your attacker guess 7 extra bits (well, slightly under) would have the same effect, so that translates to a slightly under 7 bits of entropy. Appending two randomly chosen digits to your password would have about the same effect.
Those first 5000 iterations added over 12 bits of entropy.
The article is complaining about not adding an extra 100,000 iterations which would double the difficulty, so he's effectively berating them over 1 bit of entropy.