100% agreed. Paying for a major brand password manager, you should assume that you are paying for them to always keep the security totally up-to-date with best practices. The idea that you are somehow responsible for finding an obscure setting not just in "Account settings" but in a separate "Advanced settings" that defaults to hidden, and knowing the appropriate number to set it to, boggles the mind.

Paying? What is this "paying" you are talking about?

“But look, you found the notice, didn’t you?”

“Yes,” said Arthur, “yes I did. It was on display in the bottom of a locked filing cabinet stuck in a disused lavatory with a sign on the door saying ‘Beware of the Leopard.’”

There’s an entire novella of Arthur just finding this notice, right? It could be serialized into three one hour episodes of Dent, queuing & requeuing and just talking to others inqueue.

Bc product people are hilarious!

Why not both?

Keep in mind that this is a trade-off, it requires more computational power AND battery, so giving users access to the leavers makes sense (e.g. power users with nice equipment can pump up the number).

That being said I do agree that it is up to the vendor to set AND enforce a new higher minimum. If someone logs in with 5K rounds, it should be changed to the new default (100k).

On a related note Bitwarden also allows users to configure this. I recently increased mine to 150K rounds.

I think it should allow you to change the schedule on which it increases the rounds, not set the actual number. It should tell you how many rounds it currently is at and how it will increase but the setting most people will want is High Security, Very High Security, Ludicrous Security.

Having the controls is great if you’re a technical person who knows what to do with them.

99.9%+ of people aren’t that technical person. Safe defaults need to be used and kept up to date for them.

Because changing the number of rounds requires reencryption and it doesn't sound like they had a workflow for prompting batch reencryption other than through the setting.

Ideally they'd manage that number and prompt the user to change it over time.

It's not that difficult to do though? Just implement a mechanism that re-encrypts when the user enters their password.

I agree, there's workflows they could've built to solve this problem. I wasn't defending them in the slightest.

It's because bikeshedding emphasizes customization and easy to demo features over the type of design that actually helps most users.

Because different hardware will have significant impact on this number. You need to figure out your tolerance. Maybe your tolerance is higher than they expect - cool, bump it up. I did that many many years ago, thankfully.