PBKDF2 iterations is the last in what should be a chain of defence in depth best practices. It gives limited protection against a database breach. Your passwo

PBKDF2 iterations is the last in what should be a chain of defence in depth best practices. It gives limited protection against a database breach. Your password service should have as a minimum the following extra defences. - Hardware encryption of the master password hashes. - Breach detection such as poison records. - Database access controls that limit the blast radius of an attack. - All admins should require a hardware key to access the database. I'm sure there are many more. You can defend yourself with the following... - by having a very random master password. - 2fa everywhere - password horcruxing - see https://kaizoku.dev/double-blind-passwords-aka-horcruxing https://kaizoku.dev/double-blind-passwords-aka-horcruxing