Are you referring to phishing attacks?

How would they enumerate users through the random salt? Also, are you suggesting that they try to recreate the private key and enumerate through all possible values of the private key…?

Edit: I get what you mean, you are suggesting that since the salt is returned the attacker can still attempt password replay by enumerating through simple values like 0000. That is true. This approach does not improve on that area. That being said, using derived salt would more or less make it much difficult for offline attacks, whereas API attacks can be mitigated with rate limiting, captchas and proof of work.