This question already has an answer here:
- How to securely hash passwords? 13 answers
I have read many and many of this type of question on the security stack community before I asked this question, but one thing that made me mad about salts and saving it in database is this ... I will put myself in the attacker's position.
If I hack into a database and find a table called for example ( users ) and I see a field named ( salt ) and another one ( password or hash ) I can easily - with no effort - know that the salt is used to produce this hash or this password. So I will take the salt of the first record for example and make a dictionary of all hashes of all English words ( rainbow table ) and then I'll use the salt that I got from the first record and try hashing it with each hash I got in the rainbow table and I will get the salted hash easily at the end ........ so please why do all people say on SO or the Internet say that putting the salt in the database is good practice or safe? .. I don't see it as safe and please correct me if I am wrong .. thanks in advance.
I have postponed my project because of this issue.