[s_kilk]

>> On the other hand, there's nothing stopping a developer from doing something really dumb like setting bcrypt iterations to 1.

I _really_ hope that doesn't turn out to be the case here.