-3

This question already has an answer here:

For example, a person having password 123456.

it's MD5 is e10adc3949ba59abbe56e057f20f883e and SHA1 is 7c4a8d09ca3762af61e59520943dc26494f8941b and after joining both hashes.

Which comes to be e10adc3949ba59abbe56e057f20f883e7c4a8d09ca3762af61e59520943dc26494f8941b, decreases the risk of getting brute-forced?

marked as duplicate by WhiteWinterWolf, Bob Brown, Ohnana, André Borie, LvB Jul 4 '16 at 8:13

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • 7
    If the attacker knows your scheme, it will be no stronger than MD5 alone. Use a password hashing method that is known to be difficult to attack, such as bcrypt – Owen Jul 1 '16 at 16:06
  • @Owen How can attacker know my scheme when I use PHP to encrypt them? – Naman Jul 1 '16 at 16:10
  • 3
    Don't try to make your own "smart-hashing-algorithms", people who have actually studied cryptography and it's complex math, have already done that for you. In most cases even open-source so multiple professional cryptographers have reviewed/improved it. Your implementation indeed won't really help. People will see quickly it's a mix of multiple hash-algorithms: length (MD5: 32 & SHA-1: 40) and a tool like Hash-Identifier will do the rest. – O'Niel Jul 1 '16 at 16:14
  • 3
    @NamanSood An untrustworthy hosting company, a former employee, someone who steals your laptop with your source code, someone who guesses your SSH or FTP or other remote access password. Breaches happen to the biggest and best companies. There is no good reason not to use a tried and true password hashing function, especially when PHP has it built in for you. php.net/manual/en/function.password-hash.php – Owen Jul 1 '16 at 16:29
  • 1
    @NamanSood maybe you want to improve the quesiton mentioning why you would want to do this and ask if one can suggest a better option. ex, if md5 and sha1 is the best you have availble in your programming environment, re-hashing the md5 with sha1 would be much better. – CristianTM Jul 1 '16 at 17:10
5

No, the method you have provided is considered to be security through obscurity or

the belief that a system of any sort can be secure so long as nobody outside of its implementation group is allowed to find out anything about its internal mechanisms.

and generally considered to be a bad idea.

Not the answer you're looking for? Browse other questions tagged or ask your own question.