For all of my hobby web projects, I have coded a login system that these projects share. There is no critical data in these projects, the only critical data could be reused passwords. So I try to hash passwords in a very secure way.
My current password hashing algorithm is nothing I would call really secure. And as I saw that PHP now offers build in hashing with
password_hash, I thought about switching.
My question is, what are the benefits of switching for me? In terms of, what extra protection do I get, what hole(s) do I fix, etc.? And is there anything else I have to do to not make it extremely insecure?
I would like to use the answers as a learning experience for myself so I can teach it to others who are in my position.
My current algorithm (pseudo-code):
Salt = "some-salt" Repeat 1000000 times Password = Sha512(Salt + username + Salt + Password)
I know my site is vulnerable to timing attacks and the PHP built-in functions would fix that.
What else is obviously insecure?