I am not a security expert but I am trying to get my head around the current best practices for adopting a security policy for a website that will contain sensitive information.
In terms of someone trying to access user accounts through the front door/login screen I am happy that I am familiar with enough information to make this a futile exercise.
However I also want to also guard against the possibility that the database could be hacked and a third-party be in possession of all the encrypted passwords.
It is at this point that I can't see any real advantage with using any of the MD5, MD5+Salt, AES encryption method in cases where the database is hacked and all the keys needed to test a password against any stored hash is retained in the database.
Would I not be more secure if I took an encryption method such as MD5 and used that to encrypt the user's password, and then take the encrypted string, and through code, select say the first n characters of the hash and pass that through the MD5 encryption and store that hash in the database?
i.e. take the password "password"
The MD5 generated hash would be 5f4dcc3b5aa765d61d8327deb882cf99
I take for example the first 14 characters 5f4dcc3b5aa765 and run that through the MD5 encryption to get a new Hash 316e881b8519579949391d6f8424decb which I store in the database.
Only the code would know how many characters were being used to re-encrypt the first hash code. Any hacker who is not in possession of both the database data and the source code would not be able to compare hash codes using a dictionary rules set even though they may have correctly identified that MD5 encryption is being used.
All the encryption methods I have researched so far seem to store the encryption keys in the database which doesn't seem to give much protection from a database dump hack.
It is quite possible that I am being naive here and don't understand the first thing about security but any guidance from people would who do would be appreciated.