Are salts useless for security if the attacker knows them?
hash, language-agnostic, security
Solution
No, they're not useless.
So long as you use a unique salt for each row, then the salt will prevent slow down an attack. The attacker will need to mount a brute force attack, rather than using rainbow tables against the password hashes.
As mentioned in the comments, you should ensure that the salt is a sensible size.
Problem
Let's say I have a table of users set up like this: ``` CREATE TABLE `users` ( `id` INTEGER PRIMARY KEY, `name` TEXT, `hashed_password` TEXT, `salt` TEXT ) ``` When a user is created, a randomly-generated salt is produced and stored in the database alongside the results of something like `get_hash(salt + plaintext_password)`. I'm wondering that if a malicious user gets their hands on this data, would they be able to use it to crack users's passwords? If so, what's a way that it could be prevented?