Well, in the eHarmony case we're talking about MD5 hashes, so even if you self-salt the password but still choose a weak password a good password cracker will find the password fairly quickly.
> > MD5, SHA-1, SHA-256, SHA-512, et al, are not "password hashes." By all means use them for message authentication and integrity checking, but not for password authentication.
> Bullshit. MD5 is just fine, as long as you use the salt.
Here, hack this:
MD5(password + salt) = "b520542710812f347432232b2a1fba83"
salt = "MD5 rules"
Self chosen salt, unknown password, known MD5 hashing method. Fire up a password cracker and feed it in a decent dictionary, and you get the password = "Spiderpig1".
Indeed, the hashing is useless so the salts are rendered ineffective. But again, they're not 100% useless - they still do serve their purpose, to render pre-generated tables useless. But when one can generate them again so quick it provides negligible benefit.
As an example, yesterday user rorrr posted this comment: https://news.ycombinator.com/item?id=4076840.
> > MD5, SHA-1, SHA-256, SHA-512, et al, are not "password hashes." By all means use them for message authentication and integrity checking, but not for password authentication.
> Bullshit. MD5 is just fine, as long as you use the salt. Here, hack this:
Self chosen salt, unknown password, known MD5 hashing method. Fire up a password cracker and feed it in a decent dictionary, and you get the password = "Spiderpig1". No rainbow table needed.