>>13
I don't think you understand what ``security through obscurity'' means. It usually means that something is hidden, but attainable for the user (for example DRM works like that, they give the user the key, but they will attempt to obscure/hide the key through various ways). In real cryptosystems, the key only belongs to the parties that need it (symmetric crypto would mean that only parties that need to write/read the data have the key, in public key crypto, the private keys are kept private and only one person has them). In the case of world4ch, the salt is supposed to be a private secret, but I assume that since it's a web server and they kept the file accessible via http, one day the permissions were incorrectly set and someone obtained the salt, thus the secret was exposed and the crypto scheme became insecure. To fix this, they would have to change the salt, but that would change everyone's secure tripcodes. They could either do that, or just give up the secure part of the secure tripcodes in exchange for people maintaining their old secure tripcodes.