Let's say I my password is a simple password, 123456
Then if the database was exposed, if the password was:
-- stored in plain text -> cracked
-- stored it hashed with no salt -> prone to rainbow tables -> cracked
-- stored it hashed with salt -> rainbow tables are less effective since a specific rainbow table for each salt will be needed, but at the end at least one important password can be cracked
-- stored it hashed with bcrypt -> slower time to generate that rainbow table, but at the end a powerful machine/s targeting one important password can crack it.
Can we avoid this if we chained two hashing algorithms to one hashing process ? For example hashing a password with SHA-256 hashing, then hashing the output with bcrypt ? Bcrypt(Sha(Pwd))
This way the output hash doesn't appear in any rainbow table, even it was a rainbow table made specifically for my salt I used with bcrypt and its work factor, the output is still another hash value that's not included in the rainbow table. And also brute forcing best chance will be finding the hashed value of the Sha(Pwd) (which as I think is also computationally infeasible?)