Why not? You'd rather have inferior security than wait a minute and a half[1] to access your accounts?
Shame on you, Thomas! I thought you were a professional!
[1] Based on a remarkably unscientific test I just ran on an Ubuntu 12.04 VM on my laptop. 87.8 seconds.
That's how rails stores it in the database, so trying to be as transparent as possible.
It takes 3 minutes to log into your application?
You are absolutely right. This is not our production app (ours is at 12 IIRC) but some internals app I've been playing with.
Ok just so you know the default cost factor for bcrypt-ruby is a reasonable choice, and the cost factor you've used here is unreasonable.
Absolutely. Was trying (but failing) to make a joke.
BCrypt 19s are <40s to encrypt here, using Java and not even native code. Certainly not outside the realm of usability for something you don't authenticate against all the time. I wouldn't want that for my screenlock password, but I can still see it being workable.