intridea/omniauth-identity — Issue #13: Password hash doesn't use salt
Author: ianmiller
Created: 2011-12-30 05:51:13+00:00
State: open

## Proposoal
This gem should use [salted passwords](http://en.wikipedia.org/wiki/Salt_%28cryptography%29) in order to prevent a rainbow table based attack.

I think the easiest way to do this is to have a required field (called "Salt") in the Identity model, which would be filled with a random value when a new record in the table is initialized. This salt should then be combined with the password which is entered, prior to creating the hash.

## Benefits
The advantages of including salt are:
1. If two people have the same password, a person viewing the hashed password can't tell
2. Prevents attacks which utilize pre-computed dictionaries of common passwords