I recently found this site, proposing a hashing algorithm for passwords.
They describe the following:
- pad the password on both sides with
4 * length(password)
HMAC(padded password, global salt)
- choose a random salt of 22 characters
Is this algorithm secure? I think it might be a security flaw to pad the password on both sides with the same text, and I see no point in using a global salt and a salt which is chosen randomly for every password.