That attitude was uncalled-for. I'm aware of how brute force attacks work, thank you; and when you say "it's plenty fast", I'd guess you're referring to the di

That attitude was uncalled-for. I'm aware of how brute force attacks work, thank you; and when you say "it's plenty fast", I'd guess you're referring to the difference between "slow" hashes -- like bcrypt -- or "fast" ones, like MD5. ...Which has nothing to do with whether salts are a good idea or not, which was actually my question. Furthermore, your example there assumes a dictionary to throw at the hashes, which is stupid, because if the website (or other application) doesn't have a sane password policy in the first place, then you don't even need their database of hashes. So, the whole "rainbow table" example you just sighed about was completely irrelevant to my question. Maybe I can put this another way that'll make more sense. Let's say I have a 150,000 computer botnet -- pretty small by today's standards, and not that hard to achieve really. And let's also say that I have a database of 10 million accounts that I snatched from some business, and better yet, let's say that they don't know about it, because I was uncommonly smart and I didn't brag that I got it. Now, I want to retrieve the passwords for as many of those 10 million accounts as possible, using my botnet. Further, let's say that the company was uncommonly smart, and they twofish'd all of their passwords with enough stretching to piss me off. How much more pissed-off will I be when I discover that they've concatenated a 128-bit randomly generated nonce to each password? Because my guess is, a lot more pissed off, since I can no longer distribute my dictionary of 500,000 commonly found passwords to the botnet, run it through their pessimal twofish, and then look for collisions.