So, our database is using bcrypt with a high iteration/cost to store our users passwords. We're using https like intelligent people and we continue to work on finding ways to sidestep our own security before someone else does.
With that said, we are beginning a new marketing push with a new interface and the marketing guys are wondering if we can/should/should not use the use of bcrypt as a selling point on our features page.
It seems there are so many large organizations out there that DO NOT use secure password hashing methods and even if it is kind of sad, using something like bcrypt seems like a differentiator.
So, the question that I want to ask is if advertising our use of bcrypt will paint a target on our back. I see "we use https" advertised often, but I don't see anything mentioned about password storage policies.
I don't need to know if it's a good marketing tactic, what I want to know is if its going to expose us to more danger if we do advertise the use of bcrypt.
Thanks for your thoughts.