I'm maintaining a website which uses Sha256 hashing of passwords.
The passwords are hashed with a GUID key, and a RNGCrypto generated random salt.
I'm just trying to understand the security risks associated with this scheme.
If an attacker is able to obtain just the hashed passwords, is there any way for them to be brute forced, or would they need to be also access the secret GUID on the server?
Should I recommend to my client that we change to slower hashing scheme?