2.4.4

[jmanico]

bcrypt 13 is too aggressive we should be suggesting bcrypt 10.

https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html

[Sjord]

This refers to 2.4.4, not 2.2.4:

2.4.4 Verify that if bcrypt is used, the work factor SHOULD be as large as verification server performance will allow, typically at least 13.

Work factors correspond to time roughly like this, on my laptop:

bcrypt	time
10	50 ms
11	100 ms
12	200 ms
13	400 ms

I think 10 is acceptable. I agree that 13 is a bit much.

[jmanico]

This has been updated for a different issue making this issue moot.