That attitude was uncalled-for.<p>I'm aware of how brute force attacks work, thank you; and when you say "it's <i>plenty fast</i>", I'd guess you're referring to the difference between "slow" hashes -- like bcrypt -- or "fast" ones, like MD5.<p>...Which has <i>nothing</i> to do with whether salts are a good idea or not, which was actually my question.<p>Furthermore, your example there assumes a dictionary to throw at the hashes, which is stupid, because if the website (or other application) doesn't have a sane password policy in the first place, then you don't even need their database of hashes. So, the whole "rainbow table" example you just sighed about was <i>completely irrelevant to my question</i>.<p>Maybe I can put this another way that'll make more sense.<p>Let's say I have a 150,000 computer botnet -- pretty small by today's standards, and not that hard to achieve really.<p>And let's also say that I have a database of 10 million accounts that I snatched from some business, and better yet, let's say that they don't know about it, because I was uncommonly smart and I didn't brag that I got it.<p>Now, I want to retrieve the passwords for as many of those 10 million accounts as possible, using my botnet.<p>Further, let's say that the company was uncommonly smart, and they twofish'd all of their passwords with enough stretching to piss me off.<p>How much more pissed-off will I be when I discover that they've concatenated a 128-bit randomly generated nonce to each password?<p>Because my guess is, a <i>lot</i> more pissed off, since I can no longer distribute my dictionary of 500,000 commonly found passwords to the botnet, run it through their pessimal twofish, and then look for collisions.