> You mentioned pregenerated lookup tables in a previous comment. Using email address as salt prevents that attack. Salts come with the database too. Ah right,

> You mentioned pregenerated lookup tables in a previous comment. Using email address as salt prevents that attack. Salts come with the database too. Ah right, didn't think of that! I will think of adding a preference where one can add a salt value :) > Yes, but then the user has a more difficult password to memorize, so that argument is irrelevant. But while the password-remembering difficulty scales linearly, the difficulty to crack it scales exponentially ;)