--On Friday, February 24, 2017 9:06 PM +0100 Michael Ströder <michael(a)stroeder.com&gt; wrote: > Quanah Gibson-Mount wrote: >> I think it would be wise to update OpenLDAP to a different default for >> userPassword. > > Yes! > >> We currently have the Contrib SHA2 module, > > SHA-2 hashes with one round are also way too fast to be a good password > hash algorithm. > >> It may be time to move the SHA2 module into core, > > Yes, but there should be something stronger. Did you just skip entirely past the point where I said: "but there has been some discussion of the limitations of the current SHA2 module in the past that would likely need addressing"

And yes, perhaps PBKDF2 should be in core as well. ;)