> 2) It's not abusing the algorithm, it's using a longer salt (in the concatenation case). But PBKDFs like bcrypt and scrypt are not designed to keep the salt

> 2) It's not abusing the algorithm, it's using a longer salt (in the concatenation case). But PBKDFs like bcrypt and scrypt are not designed to keep the salt parameter secret; in fact they assume the attacker knows the salt. And so if they happen to reveal the salt to the attacker, this is not considered a bug in the algorithm and won't have been flagged or fixed by cryptographers.