True, but if the global salt is secret, it'll at least make it slightly harder for the attacker to figure out the password.

For example, if the password is "a" and an unique salt is available in the database, it'll be trivial to brute force. If the password function is something like this, however: sha256("longsalt" + password + salt) the attacker will first have to figure out longsalt which can be slow if it's long.

Or am I completely mistaken?

If you can steal the password hash database, stealing the shared "salt" is usually going to be trivial. Second, lots of hash functions are vulnerable to length extension attacks, so even if extracting the shared secret directly is hard, you can probably exploit the system to see what an empty password hashes to and then use that as a basis for brute-forcing the rest.

In other words: there is a reason why security experts and cryptographers recommend the password storage mechanisms they do.

I see, that makes sense. Thanks for explaining!

But if hackers can break in and steal your database, they'll probably also be able to steal the global salt.

The recent MongoHQ breach is a counter example.