Assume a simple case, that an attacker knows the password creation scheme, and that we're not dealing with state actors, nor with sites which keep passwords in plain text. We're trying to defend against offline brute force attacks on a compromised database of password hashes. And we want the vast majority of our passwords to resist an attack over ten years.
From anecdotal evidence it seems like even sites that should know better keep passwords hashed only once. (And others in plaintext, but there's nothing to do about those.)
So it seems like the answer will depend on the following:
- Are single-iteration-hash databases really common? If not, what method is the least secure and most common? (Including iteration counts, hash types, etc.)
- And how long does it take to crack these methods. (Including common hash cracking hardware, do these databases become public and are then cracked by the best hardware out there (think ASICs),...)
- How much time do attackers spend on a password before giving up on it (Assuming unique salts)?
- More parameters?
Just saying that we'll never have enough information for an informed decision is not enough. We need some idea. We all use passwords, and not everyone uses password managers. (I'm not saying it's not a good idea. It's just a fact.)
(I initially asked this on
security.stackexchange, thinking that that would be more appropriate, but got no answer there. In fact, at first I got comments questioning the basics of password storage etc. (Which were later edited out by the mods.) So I'm asking this here instead, hoping that the crowd here will have already asked itself that question.)