>but not enough to understand why unique-per-user salts are important
I don't think that's been covered in this thread. If the main point of salting is to make rainbow tables ineffective, a single DB-wide hash still does that. Presumably if a hacker gets a copy of your entire database, they still don't have a copy of your hashing function with that salt. So then they're reduced to brute force.
Something else that I just thought of is, if you're salting per user, where does that salt get stored? A secondary database?
..And then come to find out it's been discussed down thread. Oops.
Any competent security architect will assume that if the bad guy gets a copy of the entire password database he also gets a copy of the entire codebase, all design documents, installation instructions, and operations manuals, and designs the system to be secure against that.
I don't think that's been covered in this thread. If the main point of salting is to make rainbow tables ineffective, a single DB-wide hash still does that. Presumably if a hacker gets a copy of your entire database, they still don't have a copy of your hashing function with that salt. So then they're reduced to brute force.
Something else that I just thought of is, if you're salting per user, where does that salt get stored? A secondary database?
..And then come to find out it's been discussed down thread. Oops.