When working on a website application, me and a friend asked a security expert (works at IBM) how to handle storing passwords. After hours of google searches (resulting in hours of security.stackexchange.com exploration), I determined that having a user database with the salt in the DB is secure, as long as it's a per-user salt and a slow hashing algorithm.
The security expert said that if the DB was compromised, everything was compromised, which is true. He suggested "one way encryption", which...I don't really get. Isn't hashing, by definition, one way, whilst encryption, by definition, isn't?
If anyone could clear this up, that'd be great.