I had this idea to permanently conceal user password by requiring minimum length then stripping certain characters. For example if the user password is
secret123, the system will strip it down to
ecrt12, add random characters to it like
ecrt12!@#$%^&* before hashing, adding salt, etc, then storing to DB.
Granting all common practices were also used like:
- unique salt per user
- system pepper
- bcrypt/scrypt or whatever latest best crypto algo available
To summarize in code:
$hash = hash($modifiedpassword.$uniquesalt.$systempepper) // iterated to 1000s.
In the event an attacker manages to reverse all hashes, the best info they could ever recover is
ecrt12!@#$%^&* and not the original
secret123. Even if they hack the system code, they will never know what characters were stripped.
My question now is as security experts, would you recommend this practice of stripping/appending the original user password?