It's known that all password hashes need to be salted, but a debate often arises which salting strategy to use:
- One common salt, hard-coded in the application away from the data
- One salt per one hash, stored in the database next to the hash, never reused
How do these two approaches compare against different attacks or leaks? Is one more secure than the other?