Storing Passwords Securely
The article says to give each password its own unique salt and then store the salt (as well as the salted hash) in the database.This seems like a bad idea to me.  If a hacker gets access to the salted passwords, in this case he'll probably figure out how to get access to the salts too.I figure if the salt is stored in the code (or a config file...) rather than the database itself, at least it's two different hacks to get (1) the salted hashes, and (2) the salt.Am I misunderstanding?