> Doing a large number of hash rounds has zero effect on actual security here The only way to derive the secret from a leaked password is to brute force possib

> Doing a large number of hash rounds has zero effect on actual security here The only way to derive the secret from a leaked password is to brute force possible secrets. The number of hash rounds increases the required computations. But even with only one round of hashing brute force will fail if the secret is sufficiently random (good luck brute forcing random 20 char strings). The only problems this scheme has (apart from a very weak secret) are password rotations and a leak of the main secret. Anyway, passwords should've died long time ago. Asymmetric private keys (derivable from secrets) should be a standard for user authentication.