I have a question I haven&#x27;t been able to find an answer to, hopefully someone here can help.<p>Why is HMAC+(hash) considered secure, while being considerably faster than say bcrypt with a cost of 12? For example, if a service used a user provided password to validate a &quot;secret&quot; (what would normally be the signed message), is that less secure than bcrypt? If so, what makes guessing the secret used in HMAC difficult?