As I understand it, this depends on the what the attacker has. If they have a FPGA or GPU, you need many rounds of PBKDF2. If you use scrypt, which was designed by cperciva to negate some of the advantages of FPGA and GPU, you don't need so many rounds to keep it hard to crack. Use https://hashcat.net/oclhashcat/ to benchmark.
Makes sense, thanks.
> I guess bcrypt is harder by default than PBKDF2
Does that imply that software using PBKDF2 is equally safe if it turns up the difficulty?