The best practice a few years ago was &quot;use the best PBKDF available&quot;, which hasn&#x27;t changed – just what algorithm to use. This isn&#x27;t different from any other part of crypto – we have a constant algorithm churn as we identify and replace problematic algorithms.<p>And OAuth is no exception: If you implemented OAuth five years ago, it was OAuth1, which was obsolete and ripe for replacement… <i>four</i> years ago.