title: ASP.NET Identity's default Password Hasher - How does it work and is it secure?
body: <p>I am wondering wether the Password Hasher that is default implemented in the <a href="http://msdn.microsoft.com/en-us/library/dn468199%28v=vs.111%29.aspx" rel="noreferrer">UserManager</a> that comes with MVC 5 and ASP.NET Identity Framework, is secure enough? And if so, if you could explain to me how it works?</p>
  
  <p>IPasswordHasher interface looks like this:</p>
  
  <pre><code>public interface IPasswordHasher
  {
      string HashPassword(string password);
      PasswordVerificationResult VerifyHashedPassword(string hashedPassword, 
                                                         string providedPassword);
  }
  </code></pre>
  
  <p>As you can see, it doesn't take a salt, but it is mentioned in this thread: "<a href="https://stackoverflow.com/questions/19957176/asp-net-identity-password-hashing?rq=1">Asp.net Identity password hashing</a>"
   that it does infact salt it behind the scenes. So I am wondering how does it do this? And where does this salt come from?</p>
  
  <p>My concern is that the salt is static, rendering it quite insecure.</p>