Storing Passwords Securely
The article says to give each password its own unique salt and then <i>store the salt</i> (as well as the salted hash) in the database.<p>This seems like a bad idea to me.  If a hacker gets access to the salted passwords, in this case he'll probably figure out how to get access to the salts too.<p>I figure if the salt is stored in the code (or a config file...) rather than the database itself, at least it's two different hacks to get (1) the salted hashes, and (2) the salt.<p>Am I misunderstanding?