3 ms·

Certainly not, especially if it is sent over an authenticated channel.

• dchest 9y ago
  Since getting the salt must be possible by supplying only username, one security disadvantage of such scheme is that by getting the salt of the target the attacker can precompute password guesses and store them. When the password verifier database leaks, the attacker then can more quickly verify guesses. This is a really tiny advantage and may even be more expensive than non-precomputed attack due to storage, so it doesn't matter in the real world. Another disadvantage is that if changing password also changes salt, by requesting salt over the period of time, the attacker can learn when the password was changed.