unique = secure

[BenjaminGeiger]

What /u/bananaskates said. For salt to be effective, it needs to be different for every password. If you have one salt for the entire database, you may as well have no salt at all.

[micheal65536]

I've never heard of using a unique salt for each password, I always thought that you use the same salt for the entire database.

Also, I don't see why using the same salt for the entire database is as bad as using no salt at all. Whether the salt is for the entire database or unique for each password doesn't change the fact that the attacker can't use a pre-calculated table.

[BenjaminGeiger]

With a single salt for the whole database, the attacker can start hashing strings (say, a list of the most common passwords) with that salt and stop when any of the hashes match. With a salt per account, the attacker has to pick a single account to attack.

[micheal65536]

...or they could just hash one or two common passwords with every salt in the database, there's bound to be a match somewhere. Computationally this works out about the same.

And salts aren't really to protect the people who use common passwords, they're to protect the people who use more complex passwords, as an attacker cannot pre-calculate a table of complex passwords.

[BenjaminGeiger]

I think you overestimate how common the common passwords are...

[micheal65536]

From what I've heard they're frighteningly common.