First off: I do not, nor intend to, use a home brew hash functionality, ever. I'm aware why one shouldn't do that and have read enough topics about it to know it's foolish to do.
I understand that I am no expert at the subject and that those who are could find and abuse a vulnerability in my own made algorithm and could use those conclusions to break my stored hashed passwords more easily than a more robust standard encryption.
The thing I cant wrap my head around is the following: If you assume a custom function which you put A => B, where output B is always the same for a given A. I'm aware that it wont be the best method, but please take that as is, a somewhat decent implementation.
Normally, if a hacker gained ONLY the database, they do their trick and manage to restore an amount of passwords from it. If they have a bot running, or download/generic hack/buy some hashed passwords, the hacker can repeat the standard tricks to reverse them.
Now, if I own a insignificant enough company not to get targeted specifically by hackers and implement my own 'extra sauce'1, all the 'driveby' variants of using tricks no longer work and thus would be safer.
Is there/what is the flaw in my logic? Long term this would be a worthless aproach, because what if you do become a more interesting target? Just do it right from the beginning. But what if you know you'll never be.
1e.g. I split the string in parts A & B, and concat them BAB. And then something better.