Nov 1, 2015 15:05
@k0pernikus yes but what I mean is that I can't protect my users' passwords from myself, like, I can't say to them "I hash your passwords, so don't worry, go ahead and type your password, I can't see it".. they just have to trust me that I won't steal it :)
Nov 1, 2015 15:05
@Agent_L: what do you mean by "salts protects their passwords from you"? If the website owner wants to see the passwords he/she will always be able to do that. They are the one running the hash algorithm (starting from the clear text password) at each login after all.