Stripping / appending characters from user password before hashing to conceal it forever?

I had this idea to permanently conceal user password by requiring minimum length then stripping certain characters. For example if the user password is secret123, the system will strip it down to ecrt12, add random characters to it like ecrt12!@#$%^&* before hashing, adding salt, etc, then storing to DB. Granting all common practices were also used like: • unique salt per user • system pepper • bcrypt/scrypt or whatever latest best crypto algo available To summarize in code: $hash = hash($modifiedpassword.$uniquesalt.$systempepper) // iterated to 1000s. In the event an attacker manages to reverse all hashes, the best info they could ever recover is ecrt12!@#$%^&* and not the original secret123. Even if they hack the system code, they will never know what characters were stripped.

My question now is as security experts, would you recommend this practice of stripping/appending the original user password?

• I don't see how this method could possibly work. What do you do with the result of all this hashing? What use could it possibly be? If you want to conceal it forever and don't mind writing it in a form that's not usable, why write it to the database at all? – David Schwartz Apr 30 '12 at 6:55
• @DavidSchwartz The hashes are usable. I am not sure if I get your question but if you are asking how to authenticate on login (since passwords have been stripped), the system just repeats the process on login. It strips predefined character positions from the password and appends the previously added salt. – IMB Apr 30 '12 at 8:33
• How can it re-add the same random characters? – David Schwartz Apr 30 '12 at 9:47
• The three salts do no more than one salt. This is complexity for the sake of complexity. – David Schwartz Apr 30 '12 at 10:20
• there's no difference between "adding six random characters to the password and adding a salt" and "adding a salt six characters longer than I first thought of". @DavidSchwartz is saying the cases are degenerate. – user185 Apr 30 '12 at 13:36

How would you guarantee that the "same" random characters are used every time the same user enters their password? You can only guarantee that if you write them down (or otherwise deterministically generate them), so "!@#$%^&*" in your "password" is actually just another part of the salt. This leaves you in a situation where you've converted the user's password from "secret123" to the regular expression "^.ecret12.$", which reduces the password's effective complexity from 9 characters to 7 characters. An attacker who tries "pecret129" will be allowed in.