Are there any security problems with following authentication protocol?
when user creates hers account, she provides her username and password. I store the username and blowfishEncrypt(toEncrypt = username, key = password) (lets call it token)
and then when user wants to login, i simply create token again (she needs to provide username and password) and compare the two.
The idea is to not have passwords stored in the database. But i guess i'm relying on the fact that if i know original and encrypted value, i'm not able to obtain the password.
Is there something obviously wrong with this approach?