“We will not store your password as plain text. All passwords are encrypted with the Bcrypt hashing function and individual random password salts. If your password is 123456, your password would be stored in our database in a form similar to; salt:f11ba67d8a hash:$2a$08$jRAovt7x1lgHjMGsZstzUukaE4Nga6jxfneZXPSMc6/Uhlx.rY4ri Therefore, our website - nor anyone else - will know your your password.”
Question #1: Do you think publicly disclosing password hashing is a good policy?
Question #2: Would disclosing password hashing policies disincentivise hackers from attempting to hack your password database?
Also, are there any examples of companies / websites who publicly disclose their password encryption policies on their sites / apps?
The only relevant question I found is Is it safe (or a good idea) to advertise the use of bcrypt?, which asks if encryption is a feature or a selling point.
I'm more interested in "encryption disclosure" as a policy and a deterrent to hackers.
PS: This is not a question about which password hashing scheme or use of salts is best.
EDIT: To be clear, I’m not interested in the pros and cons of “Security Through Obscurity.”
In the past several months and years, we’ve witnessed high profile data breaches and found out that apparently sophisticated companies are storing passwords in plain text or with a very low standard of encryption.
So my question is, is how do we communicate to users and the world we’re storing their passwords with strong encryption?
And like @JonathanGarber mentions in the comment below, should we disclose specific methods, instead of saying useless things like "we meet industry standards" or “military-grade encryption”