Quote:
Originally Posted by fowlplay4
Long text...salt
|
Is it really necessary to add the salt onto the password, even when the password is hashed?
Since your storing the salt in the database anyways,
if the database was compromised, they would be able to see the salt, then just take that away from the password and have the hashed password anyways.
I'm not arguing that you shouldn't use it, i'm asking why use it.
Edit: Nvm, I didn't notice you were using the salt inside the md5() hash...
However, I still dont see how this would make the login any more secure, since the salt is automatically added to the password on login attempt.
If you were trying random passwords, you would still only need to know the single password, and the salt would be added...
At least on say, a website, how would this add security? Since if a system was trying random password to break in, it wouldn't need to know the salt anyways...