I had this idea to permanently conceal user password by requiring minimum length then stripping certain characters. For example if the user password is secret123
, the system will strip it down to ecrt12
, add random characters to it like ecrt12!@#$%^&*
before hashing, adding salt, etc, then storing to DB.
Granting all common practices were also used like:
- unique salt per user
- system pepper
- bcrypt/scrypt or whatever latest best crypto algo available
To summarize in code:
$hash = hash($modifiedpassword.$uniquesalt.$systempepper)
// iterated to 1000s.
In the event an attacker manages to reverse all hashes, the best info they could ever recover is ecrt12!@#$%^&*
and not the original secret123
. Even if they hack the system code, they will never know what characters were stripped.
My question now is as security experts, would you recommend this practice of stripping/appending the original user password?