Traditionally, a 'salted' hash of the password is stored along with the salt so there is no plaintext in the database and still be able to authenticate the password.
The salting process consists of appending the salt to the password string and then hashing the resulting string, right?
I just realized that if the password is an empty string, the salted password hash would be the same as the hash of the salt.
This is an obvious security issue since a stolen database would still leak information about the passwords if the attacker would simply hash all the salts and compare them with the salted password hashes; any matches would reveal empty passwords.
The obvious solution would be to limit the minimum password length.
The question is, am I missing something in my understanding of the traditional salting/hashing procedure?
I'm not asking how to securely store passwords, I'm asking whether a blank password does leak information or my understanding is wrong.