This question already has an answer here:
I'm currently going through a course on software security. I've recently been introduced to the idea of password salting, where a random value is concatenated to a password prior to being hashed and stored. I believe I understand the operation correctly, but I don't understand how this makes the process itself any more secure.
Obviously, for authentication to occur, there has to be a reference to the salt used for the specific password during creation, thus creating a matching hash. In this reference there is a direct link to both the salt and the password/hash. If a perpetrator has access to the database, thus compromising both the hashes and salts, would he not have access to the algorithm or references to the salt as well?
Based on my understanding of salting, this method seems to be security by obscurity.