1. It depends on the randomness that can be achieved on your machine. I don't remebmer the exact details, but the wordpress.org API is there if the randomness of your machine is not good enough.

2. Probably not. If someone has that kind of access to your DB or code then you are toast in any case and getting the salts is the least important problem you face.

3. What would be a reason to do that? getting those 8 values from the DB will make every page being served very slightly slower without adding any value to your security.

Edit: why randomness (entropy) matters

first, maybe this http://security.stackexchange.com/questions/61676/why-do-wordpress-installations-retrieve-the-crypto-secrets-remotely-on-installat will explain it better then me

The issue is that salts should not be guessed, therefor they are generated by relaying on some random number generator, which most OS has. But not all random generators are created equal and if for example your generator do not take as an input some values from the enviroment it will generate the same sequence of numbers and therefor anyone which inspects the behavior of the OS can come up with say the first 1000 numbers that are going to be generated, use them as salts, and have easier time guessing your password.

This is especially problematic in a shared hosting enviroment where all sites use the same random generator, and therefor have access to the sequence of the randomly generated numbers and based on the knowledge of the OS and the random algorithm employed by it can guess the next and previously generated numbers.

side note: this is the reason why smartphone and other software asks you to do some random input when initializing the devices/software. That random input serves as a base for random number generation and ensures that each device will generate a different sequence of numbers.

The advantage of using wordpress.org as your random number generator, is by knowing that the numbers generated by it are impossible to guess without access to the servers as you don't know which algorithm, is being used, how it was initialized and where in the sequence you currently stand.

But as the question I linked to says, relaying on external service is also a security problem. I find this to border paranoia as this kind of attack avenue requires sophistication most attackers lack (in the context of attacking wordpress sites), and I would not worry about the quality of the random generator, but if you do, all you have to do is generate the salts by yourself, maybe by using some random generator software which is not related to the server, and update the config file.

1. It depends on the randomness that can be achieved on your machine. I don't remebmer the exact details, but the wordpress.org API is there if the randomness of your machine is not good enough.

2. Probably not. If someone has that kind of access to your DB or code then you are toast in any case and getting the salts is the least important problem you face.

3. What would be a reason to do that? getting those 8 values from the DB will make every page being served very slightly slower without adding any value to your security.

Edit: why randomness (entropy) matters

first, maybe this https://security.stackexchange.com/questions/61676/why-do-wordpress-installations-retrieve-the-crypto-secrets-remotely-on-installat will explain it better then me

The issue is that salts should not be guessed, therefor they are generated by relaying on some random number generator, which most OS has. But not all random generators are created equal and if for example your generator do not take as an input some values from the enviroment it will generate the same sequence of numbers and therefor anyone which inspects the behavior of the OS can come up with say the first 1000 numbers that are going to be generated, use them as salts, and have easier time guessing your password.

This is especially problematic in a shared hosting enviroment where all sites use the same random generator, and therefor have access to the sequence of the randomly generated numbers and based on the knowledge of the OS and the random algorithm employed by it can guess the next and previously generated numbers.

side note: this is the reason why smartphone and other software asks you to do some random input when initializing the devices/software. That random input serves as a base for random number generation and ensures that each device will generate a different sequence of numbers.

The advantage of using wordpress.org as your random number generator, is by knowing that the numbers generated by it are impossible to guess without access to the servers as you don't know which algorithm, is being used, how it was initialized and where in the sequence you currently stand.

But as the question I linked to says, relaying on external service is also a security problem. I find this to border paranoia as this kind of attack avenue requires sophistication most attackers lack (in the context of attacking wordpress sites), and I would not worry about the quality of the random generator, but if you do, all you have to do is generate the salts by yourself, maybe by using some random generator software which is not related to the server, and update the config file.

1. It depends on the randomness that can be achieved on your machine. I don't remebmer the exact details, but the wordpress.org API is there if the randomness of your machine is not good enough.

2. Probably not. If someone has that kind of access to your DB or code then you are toast in any case and getting the salts is the least important problem you face.

3. What would be a reason to do that? getting those 8 values from the DB will make every page being served very slightly slower without adding any value to your security.

1. It depends on the randomness that can be achieved on your machine. I don't remebmer the exact details, but the wordpress.org API is there if the randomness of your machine is not good enough.

2. Probably not. If someone has that kind of access to your DB or code then you are toast in any case and getting the salts is the least important problem you face.

3. What would be a reason to do that? getting those 8 values from the DB will make every page being served very slightly slower without adding any value to your security.

Edit: why randomness (entropy) matters

first, maybe this http://security.stackexchange.com/questions/61676/why-do-wordpress-installations-retrieve-the-crypto-secrets-remotely-on-installat will explain it better then me

The issue is that salts should not be guessed, therefor they are generated by relaying on some random number generator, which most OS has. But not all random generators are created equal and if for example your generator do not take as an input some values from the enviroment it will generate the same sequence of numbers and therefor anyone which inspects the behavior of the OS can come up with say the first 1000 numbers that are going to be generated, use them as salts, and have easier time guessing your password.

This is especially problematic in a shared hosting enviroment where all sites use the same random generator, and therefor have access to the sequence of the randomly generated numbers and based on the knowledge of the OS and the random algorithm employed by it can guess the next and previously generated numbers.

side note: this is the reason why smartphone and other software asks you to do some random input when initializing the devices/software. That random input serves as a base for random number generation and ensures that each device will generate a different sequence of numbers.

The advantage of using wordpress.org as your random number generator, is by knowing that the numbers generated by it are impossible to guess without access to the servers as you don't know which algorithm, is being used, how it was initialized and where in the sequence you currently stand.

But as the question I linked to says, relaying on external service is also a security problem. I find this to border paranoia as this kind of attack avenue requires sophistication most attackers lack (in the context of attacking wordpress sites), and I would not worry about the quality of the random generator, but if you do, all you have to do is generate the salts by yourself, maybe by using some random generator software which is not related to the server, and update the config file.