[d33]

Doesn't it only apply if the salt is known or constant? If I passed you hash(x) + aes(random_salt), would this attack work?

[Xylakant]

The salt must never be a constant, the entire point of a salt is that two identical inputs do not hash to the same value. However, it must be stored alongside the hash, so that you can later verify the hashed value. Many modern password hash functions (bcrypt for example) do store the salt as part of the hash.

[d33]

That's not the point. Salt is constant, but different for each entry. They can encrypt the salt and when they share it with hospitals, those can't reverse the hash but FB can. Doesn't it solve the problem?

[twanvl]

If you don't store the salt, then you might as well generate random numbers.