Authorities on password hashing best practice I am trying to understand how best practices on password hashing come about. With password hashing, I mean specifically for the case of storing user passwords in a database in a hashed representation, in order to compromise user passwords if an adversary gets access to the database. I understand that recommendations (especially algorithm, number of rounds, etc.) continue to change.

My question is, who would be authoritative sources on what is currently best practice, and where and how can I keep up to date?

Right now my process is that I notice someone saying something about best practice in a StackOverflow answer that does not fit my understanding, and then I start digging for more information. This seems backwards, and I'd like to get ahead on this thing.
The best place to start is the password hashing competition. It was run by and had many entries by competent researchers. You don't make a mistake going with their recommendation.

If you are interested in ongoing discussion I suggest their mailing list.