I have been tasked been tasked by my boss to change the encryption system of our web application from MD5 to PBKDF2 as MD5/SHA1 has been shown to be breakable in recent years .
I argued against it and thought we should allow users to attempt to login a maximum of 200 times a day , anything more would result in a locking of the user account . My rationale was that PBKDF2 would soon be broken in a few years time and we would have to change our encryption system again hence why not just limit the number of times a user can attempt to login. My boss however insists on me implementing PBKDF2
These are my following questions :
1) Is my rationale for wanting to limit the number of tries a user can login reasonable ??
2) Are there any flaws in my argument
3) Is my boss correct ???