Suppose we have passwords that are statistically 7-8 characters long. Is appending a 200 character long salt less secure than a 5 character salt, because of the similar hash function inputs?

I was wondering: what if someone tries to guess the salt by brute forcing the salt with for example the password "123456", or another popular password that can be found in the system or even on a known password from the hacker's own account?

As Mike and Gumbo have mentioned in comments, a salt isn't intended to add protection to bad passwords. It's meant to keep the attackers from breaking the whole database at once. The length of the salt isn't meant to add difficulty to breaking the stored passwords. It's meant to ensure that your salt is reasonably unique compared to others on the Internet, and (if you're doing it right) no two of your users will have the same salt.

Imagine you have 20 users who all have "god" as their password. Consider the following scenarios:


Passwords are unsalted
The attacker can use a precomputed table to break one user's password in very short order. On top of that, once he has the first of the 20, he'll also have the other 19 since their hashes would be identical.
Passwords are salted. Salt used is fairly short. Same salt is used for all users.
The attacker might have to look for a bit, but could possibly come across a precomputed table made specifically for your configuration. After that point, see scenario 1.
Passwords are salted. Salt used is reasonably strong. Same salt is used for all users.
Chances are, the attacker won't find a pre-computed table for your system on the Internet. He'll have to make one of his own. This will take a bit of extra time. However, after that's done, we're back to scenario 1 again.
Passwords are salted. Salt used is reasonably strong. Each user has a unique salt.
This is what you should be doing. Not only will the attacker not be able to find a precomputed table for your system, it's not even worth his time to make his own. Any pre-processing he might do would only work against one user. Even if he hits one of the 20 users mentioned earlier, he won't know the other 19 because the hashes will all be different. Each password must thus be individually attacked, and that's going to take awhile if you're also using a strong and slow hashing algorithm like you should be. Chances are, the weak passwords will still end up compromised eventually. It's just going to take the attacker a good bit more time to get through them all, and you won't have chunks of your users getting compromised at once just because they have the same password.


So, use long salts and make them unique per-user. But don't count on that to help individual users much if they're using "god" as their password.
