In a recent discussion somebody mentioned the following hashing scheme:
passHash = sha256(password) saltedHash = sha256(passHash+passHash.substr(-10) finalHash = sha256(secret+saltedHash)
The password is hashed, then hashed again with the last 10 characters of the previous hash as 'salt'. Finally a secret is appended and everything is hashed again before it's saved to the database.
How secure is this? I know that equal passwords will have the same finalHash. But apart from that, how bad is it to use part of the hashed password as salt? Does having a secret salt later help? How bad is it to have only 3 iterations of sha256 instead of a few thousands? Is there an easy attack that proves this hashing scheme is bullshit?