Increasing the default number of PBKDF2 for existing accounts

Palant’s article, while highlighting a problem that was already known, is unnecessarily sensationalistic and alarmist. In fact I posted about this issue a month ago, and no one batted an eye. And now, all of a sudden, there is full-blown panic.

Although the issue exists and should be addressed for added security, it is a tempest in a teacup. The difference between 100,000 and 200,000 iterations is the equivalent of 1 bit of entropy in your password. Even the few early adopters who may have had their iteration count set at 5000 should have little reason to panic; in their case, the equivalent entropy difference is only 5 bits, equivalent to removing a single character from an all-lowercase password. If your password is so weak that this change would make the difference between your vault being crackable or not, well, then you probably have bigger problems.