Ok, so I've been reading (a lot!) about security and the whole deal about hashing, salting, encrypting, etc. and something I keep seeing is really bugging me. It seems a lot of people that really seem to know their stuff keeps saying it's OK to store the salt with the hashed password in the DB.
I can't help but to wonder, why? What if your DB is dumped? They have access to everything which, to me, means they can look at any one record and voila(!) there's the hashed password and the plain text salt right next to it. That gives them the info they need to run it against rainbow tables and/or dictionary attacks doesn't it?
I must be missing something (yeah, that's never happened before!!) and would really enjoy some enlightenment on the matter.