I leave another one of my opinions here and go to bed to wake up to an onslaught of hate...

But, salting passwords is problematic.
I'll do it, I am a hypocrite. I don't want to explain to my customers why I haven't done it.

But the issue with a salted passwords is that we defend our users' data against a possible leak. Plus a tiny bonus against timing attacks. It is not defended against us. We can just log the password in clear text or refuse to hash it or hook inbetween reverse proxy and application.

1. When they are salted, we make rainbow table attacks harder. More compute intensive.
2. When they are salted, we cannot quickly identify people with the same password. Therefore not quickly isolating people with a simple password.

And that's bad.

Let me first start to explain one thing. Imagine you have a generated password. Random characters. Like 50 of them. And you used that password on one website. Not on any more. With a password manager. And now you hear that this website leaked their database. Do you worry? Well, no... If that website itself was not embarrassing. You just log in, set a new one, done. You don't care about it.

We only care about salting because upstream users have not used good passwords. Salting is only there to mitigate password reuse. And because it is good at doing that, people keep reusing passwords.

If we didn't mitigate it, the dangers of reusing passwords would be so widely known. Everyone and their grandmothers knew how to keep good passwords. But sadly, we mitigate and most of us are trust worthy.

Users don't meet us. They don't know who we are, they shouldn't give us their everywhere password. But they do. Because we are too trustworthy, we take good care of it and we mitigate the bad outcomes. If a user leaked their password to us, it is too late. They gave it to a party they shouldn't have trusted. Sadly, we turn out to be trustworthy too often.

And if I wanted to steal a huge amount of passwords, I just create a quick website that turns images into gifs or something stupid. Converts webp into png. For free. Just sign up. We conditioned them to trust website services.

Yea, so, basically, my daily PSA, we have done our users a disservice by mitigating damage at a point after the mistake has already happened.