Password Hashing add salt + pepper or is salt enough?
How to store salt?
Ok I have been studying a lot about password hashing lately. And I have a few questions. So I will explain what I know (if I have gone wrong anywhere along the way, please correct me so I may learn) so I can show you where my confusion lies.
So the reason why I want to hash my users passwords is so that if a hacker gets a hold of the database, he can't just use their emails and type in their passwords to steal their money. It also makes it so any admins cannot see what their passwords are. So the bottom line is to keep my users safe.
Using just a hash like
MD5 is not good enough because rainbow tables can be used to figure out what their password is immediately and fast computers can just crack those anyways regardless of salting or not.
But it is important to use salt when hashing to make sure rainbow tables cannot be used and forces hackers to have to brute force their way into finding out the password. So when we are storing the salt, lets say by appending it to the hash,
<hash>_<salt> it doesn't matter if its in plaintext because hackers are forced to brute force the hash.
So now onto my questions.
1. Why don't I encrypt the salt from my code and then store the encrypted salt in the database?
It seems like if I did this, then it would be impossible for a hacker to ever brute force and get the password because they would assume the salt is plaintext when really it is not. So they would try and try and never come up with the password. But this leads to my second question.
2. How can a hacker tell what kind of hashing algorithm I used when looking at the database?
If I hashed my password using bcrypt and then hashed that using scrypt and on and on, it seems like the only way to be able to figure out the order of hashing is to be able to see my code.
Ok in order to help explain myself better, let's make up a scenario. A hacker uses some form of SQL Injection to print my entire users list, getting 1000 rows of emails with hashed passwords. These passwords I appended my salt which has been encrypted with my key that's only kept in the code. How would the hacker even know that the salt is encrypted? And if he somehow discerned that it was encrypted he wouldn't be able to decrypt the salt unless he had the key. Which the only way to get the key is if he had access to my code. If he had access to my code, then at that point, he would see exactly how I hashed and salted my passwords so he could easily duplicate the process whether or not he had my key anyways and then start brute forcing to get the passwords. So it seems like doing something like encrypting the salt would stop any hacker who didn't have access to the code from ever figuring out the passwords. Is this not true? If not, please explain it to me in detail. =D