Are there any security disadvantages of automatically increasing security when I get new sign-ins? I'm currently using pbkdf2 with a target time of ~1 second. I was thinking I'd time it every time, and if the time started to drop below ~.9 seconds, I'd increment the iterations and update the stored hash.