note 103583 deleted from security.database.storage by cmb

Note Submitter: Reiner ---- Using functions to obfuscate the hash generation does not increase security. This is security by obscurity. The algorithm used to hash the data needs to be secure by itself. I would not suggest to use other data as salt. For example if you use the username, you won't be able to change the values without rehashing the password. I would use a dedicated salt value stored in the same database table. Why? Because a lot of users use the same login credentials on different web services. And in case another service also uses the username as salt, the resulting hashed password might be the same! Also an attacker may prepare a rainbow table with prehashed passwords using the username and other known data as salt. Using random data would easily prevent this with little programming effort.