2.4.2 Salt size recommendation

[ThunderSon]

In 2.4.2, it is mentioned to have a salt of 32 bits, which is barely 4 bytes.

I believe this should be raised to 128 bits, to ensure that it is random enough across the DB and across other used DBs.

The best thing would be to match the hash length and go beyond it, but that might be too much.

[jmanico]

There is no need to salt modern password storage algorithms (they do it for you). Please see the following for very updated advice: https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html

[Sjord]

See also #1002.

[jmanico]

#1000

[jmanico]

Salts have been removed from 2.4 making this issue moot.