As I feared, I changed the iterations myself at some point, and they never "migrated" it to the new value. So it's above the old default, but well below the recommended number of iterations.<p>I don't suppose it being a non-obvious value makes it any more secure? Is an attacker brute forcing the thing likely to try obvious default values first and then give up if they don't work? Or will they simply +1 the iteration count until they hit paydirt?