Salt, passwords and security
- by Jonathan
I've read through many of the questions on SO about this, but many answers contradict each other or I don't understand.
You should always store a password as a hash, never as plain text.
But should you store the salt (unique for each user) next to the hashed password+salt in the database. This doesn't seem very clever to me as couldn't someone gain access to the database, look for says the account called Admin or whatever and then work out the password from that?
