Take it easy men, He already stated he was wrong. Do not punish him for wanting to answer fast and be open with the Hacker News community.
First, he was way off the mark on a number of unrelated elements, not just the key-strengthening algorithm.
While it's good that he owned up to his mistake, it's clear from his wording that he was shaky on the actual principles of security and encryption, not just
My standards for a security-sensitive product are far higher than for anything else. Any person in any position of authority should have a very clear understanding of the security fundamentals being used. The last thing I want in a 2FA application is for an overeager PM to make a decision that inadvertently compromises the security of the product, in a well-meaning attempt to improve the UI, branding, monetization, etc.
Product design and technical implementations do not happen in separate silos. And I want the security products that I use to inspire a much higher level of trust than some generic tool.