Understand the need to protection credentials with hashes that are expensive and to use cryptographically random salts.
What I would like to understand is why you would store the salt along side the hash in the database, does this not defeat the point of having one?
Take a SQL injection vulnerability in which I can dump the data in the User table. If I have access to the Hash as well as the salt does it not make my brute force attempt easier (as apposed to not knowing the salt?).
If storing the salt with the hash - does this not defeat the point of protection against rainbow attacks? (if an attacker has access to the database).