Isn't the extra security gained by salting rather illusory? If you lose a copy of your database, which is one of the two attacks under consideration, any individual password is discoverable. If you store the password and the salt in the database, that is all that is needed to play "guess that rainbow table".
If you have someone with access to your server or source control go rogue, every password entered into the website should be presumed compromised.
(Why attack stuff from your database, necessitating a costly rainbow table, when you have write access to Ruby code? The most obvious solution to me is just turning off Rails' feature to strip passwords out of the log, but given that you can monkeypatch anything you darn well please from anywhere, you have literally unbounded access to the cleartext params[:password] to steal any time you darn well please.)
If you include some random data in the salt, it's impossible to create rainbow tables out of it. Thus the attacker would have to bruteforce every single password, which will take its time (specially on bcrypt).
Salting doesn't make it impossible, it just takes longer time.
Exactly. Salting is a constant factor de-optimization of the password cracking process. If your users are choosing good passwords (i.e. precomputed table based attacks don't work) then you don't need it. If they aren't (and they aren't!) then salting at least gives you some hope that such an attack will be infeasible for a given attacker's hardware.
In practice, the constant factor can be very large, so this isn't a meaningless trick.
If you have someone with access to your server or source control go rogue, every password entered into the website should be presumed compromised.
(Why attack stuff from your database, necessitating a costly rainbow table, when you have write access to Ruby code? The most obvious solution to me is just turning off Rails' feature to strip passwords out of the log, but given that you can monkeypatch anything you darn well please from anywhere, you have literally unbounded access to the cleartext params[:password] to steal any time you darn well please.)