I've read now the whole day about password hashing and secure authentication and though I read very often that mostly every own algorithm makes the proven hashing methods just less secure, I just got an idea regarding password hashing e.g. with scrypt, salting the password and using a pepper:
Mutating the original password before hashing could probably improve security if using a random string every time and use that to obfuscate the password. Obfuscating with one specific schema alone wouldn't improve security but using all the time a new random string (which has to be as random as possible) would make it impossible for a hacker to get the password as long as he doesn't have that random string.
As you would need that random string for verifying the password you need to store and read it in some way, which makes it vulnerable of course again to hacker attacks. I would save these random strings with the uuid of the user as key and would encrypt the actual content with a password by using openssl_encrypt (a php function) on a different server.
Now the problem would be the password with which the obfuscation passwords are encrypted. So I came along the idea to show the user initially after registration a random sequence of dictionary words that are not stored at all and the user would be prompted to write it down. As additional protection i would use here also a pepper to strengthen the insecure dictionary passphrase. Now the user needs to answer upon every login a security answer, which is then used to decrypt the random string from the other server that is necessary to verify the normal password. If he loses this security answer passphrase he can reset his password using his email.
Upon Registration only strong passwords can be entered and every password is stored with scrypt hashing, a salt and a pepper (which lies on a third server). Before hashing it, it gets obfuscated. Now I wouldnt use a static pepper which is then vulnerable again, but since there is a third server anyway I would dynamically generate that pepper.
What do you think would this method add more security or would it even be less secure? This is not absolutely about using it in production environment but more about my interest in that topic itself and understanding it better.