Hacker News Reader

PBKDF2 uses HMAC the same way that multiplication uses addition.

So your objection here actually has nothing to do with HMAC at all, but with doing password hashing without iterations?

My complaint is about using a fast PRF where they should be using a slow PRF, yes.