Hacker News Reader

As the defender, you don't care if the salt is obtained by the attacker. The salt is not a secret. It's only use is to ensure that each password is hashed as unique, even if the users chose the same password. Basically, it is for defeating precomputed databases (rainbow tables), nothing more.

You store a salt per user. Salts protect against rainbow table attacks. The salt doesn't have to be private for it to be effective at that task.

Every randomized password hash does exactly this; the randomizing nonce is tiny compared to the hash itself.