That's not what I said. Some amount of secrecy might better than none. But, you should not depend on it. If you use a "clever" scheme to store / generate your

That's not what I said. Some amount of secrecy might better than none. But, you should not depend on it. If you use a "clever" scheme to store / generate your salt, you make your system more complex in an attempt to hide something that does not really need to be hidden. You might also end up introducing implementation flaws. That's why bcrypt uses nonces for its salts, and simply appends them to the encrypted passwords. Also see http://en.wikipedia.org/wiki/Kerckhoffs%27s_Principle http://en.wikipedia.org/wiki/Kerckhoffs%27s_Principle