> if you set things marginally high, it's a relatively easy point of not just login attack, but a DDOS attack surface as well That's no excuse for using a wors

> if you set things marginally high, it's a relatively easy point of not just login attack, but a DDOS attack surface as well That's no excuse for using a worse hashing method. You need to rate-limit login attempts anyway to prevent (or at least make impractical) brute forcing / dictionary attack attempts. But it's a can of worms either way (next step is captchas because of tor / anonymizer proxies etc.).