And there's a reason why high-level libraries like bcrypt handle salt generation and storage internally: if they didn't, people would screw it up. It's amazing

And there's a reason why high-level libraries like bcrypt handle salt generation and storage internally: if they didn't, people would screw it up. It's amazing how many people blithely use some crazy scheme like pwhash = md5("this is my salt" + password) Progress in password hashing security is primarily progress in making things trivially foolproof and then hectoring people into using them.