[eluser]bretticus[/eluser]
Hahaha, great thread!
You guys have me convinced on 2 points:
1. There is no way to protect a hashed password in a database if the attacker has access to your code and data UNLESS the password is sufficiently strong (not part of the dictionary list.)
2. When I want to be as secure as possible, I'm going to use a per-user AND a site-wide salt. Of course, that is only going to protect my weak passwords if the attacker gets the database OR the site code AND NOT BOTH. Which brings me back to ENFORCE STRONG PASSWORDS.
Cheers
