Why salt is either appended or prepended to the password? I know that regardless of where you place the salt, it protects the passwords against pre-computed attacks and also makes sure that all users will have a different password hash, but why not protect it further against brute force attacks as well?
My train of thought is this; if the attacker has the db dump, knows the hashing algorithm and has a table of commonly used passwords, the attacker can then target one of the users via brute force attack. He would take the salt of this user and append/prepend that salt to each one of the passwords he has in his table to generate 2 hashes (maybe even one if he knows whether the salt is appended or prepended) then compare these hashes to the user’s hash. If the position of the salt is different, that’d immensely increase the computational power the attacker needs to compare just one password.
However I know that this is not a common practice. My question is why? It’s not really that complicated to implement something like this, and it provides increased security against brute force attacks.
3