3 ms·
This isn't a PBKDF2 problem. It's a password problem with roots in practicality and psychology. His password has absolutely not been 20 random characters, but i
by daneel_w 4y ago
This isn't a PBKDF2 problem. It's a password problem with roots in practicality and psychology. His password has absolutely not been 20 random characters, but instead something easy to remember and type in, quite likely just 3 or 4 common words.
- bob1029 4y agoPbkdf2 is designed to protect the users from their own bad choices more than anything else. In fact if you think about it, pbkdf2 with a high number of iterations could become quite costly at scale. How much are you willing to pay to protect a given user from themselves? If someone uses a proper password, one iteration is all you need.