[Zimahl]

Isn't the main security feature of hashing that you hash against a salt and that no one but the server knows the salt? Once you send the salt to the client (and anything on the client should be considered insecure) you give the ability to generate lookup tables for common passwords. Without the salt it's much harder to brute-force the password.

[UncleMeat]

No. Salts are not intended to be secrets. The expectation is that in the case of a breach that salts are also exposed. What they do is prevent precomputation of lookup tables, granting the developer a bit of time after a breach before all bets are off.

[nikisweeting]

Just use a different salt on the client and server. (and potentially even a different salt for each client)

[fhars]

No, the salt can be public (it was on Unix machines before the invention of /etc/shadow). The important thing is that it is unique per password, so that Hash(Salt#Password) is unique even if two passwords happen to be the same.