Best practices for secure passwords

[eluser]Adam Griffiths[/eluser]
Dynamic salts should never be used on their own, for the very reason stated above, if somebody had a hold of the database, then they have the dynamic salt. So dynamic salts (in my opinion) should always be used with a static salt.

But of course even if somebody did have a hold of the database, they wouldn't necessarily be able to find the suers password because they have no idea how you used the salt. You could have split the password into three parts, put the dynamic salt in the first break and the static salt in the second break.

You should never be limited to just putting salts on the end or at the beginning of strings.