Uh... the specific advice I was replying to was <i>precisely</i> to use a specific python wrapper around Argon2, which is certainly not isomorphic to the &quot;best PBKDF available&quot; (even if it might be right now).<p>And the OAuth point is misdirected: we&#x27;re talking about hash choices here, which OAuth is not.  An OAuth1 client, while perhaps obsolete for other reasons, <i>would certainly</i> be protected against the need for a change in password hash, because all that stuff happens upstream and it never sees the password.  That is by design, therefore remote authentication against highly-trusted password verifiers[1] is a good idea, which is what the great-grantparent post was saying.<p>[1] Which, sure, has its own list of worries unrelated to hash behavior.