I've decided to use Argon2id for storing users' passwords in my database. I have two questions:
- Because there are several input parameters (parallelism, iterations etc.) that can influence the output result so I'm wondering if it's a good idea to store those parameters in the database e.g. in a column next to the stored passwords. Can it decrease somehow the security?
- Because the users who use our application can have a different computer (our application is running on their side, it's a windows app) thus also a different computing power. How to correct set those parameters so it is secure enough but not too slow for users? Is there any recommended settings? Or the best way would be to run a performance test before a first run of the app and choose the parameters according to that (e.g. a goal is that the calculation of the hash password has to bee between 300-500 ms)