I've been doing some research on password hashing/salting. It is my understanding that the salt doesn't need to be secret. But I haven't read anything about the hash itself needing to be secret.
How obscured does the actual hash need to be?
Say I have this simple database table:
I have an online database, well secured/hidden. I can store the salt and hash without any additional encryption, etc... But what if certain users of this database are stored in a local Android SQLite database for offline access. The table looks the same, but now the salt and hash are only protected by a non rooted device (https://stackoverflow.com/questions/3140230/sqlite-database-security). The actual SQLite database can be read easily if someone made a copy of the hidden file. Is it still safe to store the user's salt/hash in this SQLite database as is (each user has a different salt)?