Hacker News Reader

So your objection here actually has nothing to do with HMAC at all, but with doing password hashing without iterations?

My complaint is about using a fast PRF where they should be using a slow PRF, yes.