I know md5 is considered non-secure but what if someone used md5(md5(password).salt) instead? Isn't this technically better / more secure?
md5(md5(password).salt) is just as secure as
All the difference i can see is the additional MD5 calculation
md5(password) which increases the computing time the attacker needs to spend by a little and it may not be going to make a big difference.
Lets say the attacker takes the most used 100 passwords like
welcome,monkey with md5 values
He need to brute force password as well as salt in
md5(md5(password).salt) using the list
He can simple do away with that additional MD5 calculation by using the list of md5 values calculated one time.
Such combinations are often supported out of the box by password cracker tools. Have a look at the algorithms of hashcat you will see a lot of similar combinations. MD5 is not appropriate to hash passwords because of its speed, brute-forcing is ways too easy (about 100 Giga MD5 per second), so no it is not secure.
When you are using md5(md5(password).salt) method it's as strong as md5(password.salt). It seems, that it need more time to find a collision when you are using md5(md5(password).salt) method. In that case, you can use bcrypt to manually slow down the collision attack operation. And using old md5 - bad idea.