I would like to allow users of my web application to have long passwords, if they so wish. Today I became aware of bcrypt's password length limitation (72 characters, the rest truncated).
Would it be secure for me to do the following? I am using PHP.
password_hash($password, PASSWORD_BCRYPT, $options);
Implementation in question:
password_hash(hash('sha256', $password), PASSWORD_BCRYPT, $option);
What are the drawbacks of the implementation in question?
I am not a crypto expert, please advise.
Will the implementation in question limit the password length that a user can use? If so, what will the limit be?