# Is this algorithm secure?

I recently found this site, proposing a hashing algorithm for passwords.

They describe the following:

1. pad the password on both sides with SHA1(email) to 4 * length(password)
2. HMAC(padded password, global salt)
3. choose a random salt of 22 characters
4. bcrypt(hmac, salt)

Is this algorithm secure? I think it might be a security flaw to pad the password on both sides with the same text, and I see no point in using a global salt and a salt which is chosen randomly for every password.

-
so it doesn't matter that the sha1(email) is used on both sides of the password? –  pascalhein May 19 '13 at 8:16