Hacker News new | ask | show | jobs
by stouset 4840 days ago
There is zero requirement that salts be kept secret in the event of a password database breach. Salts are to prevent users with identical passwords from having identical password hashes, thereby defeating rainbow table attacks (and other attacks involving attackers being able to reuse work from other accounts).

Your approach offers effectively zero additional security; it is trying to add "features" to salting that don't work towards their actual purpose.

Edit: If you want to have something site-wide that an attacker wouldn't have while decrypting an offline password database, the thing you're looking for is an encryption key.