Will hashing both the username and the password yield any security benefits ?
I meant this scheme :
1.User enters E-mail address
2.Calculate Hash(e-mail) address
3.User enters password Calculate Hash(password) .
4.Match the values to indicate a successful or failed login .
Wouldnt this make it a bit harder to match cracked hashes to the corresponding users.
I dont know if this is already used or if this idea is just impractical for some reason I havent thought of . I didnt find anything in my searches so I asked here.
It would make login credentials harder to crack, but it would also mean that you wouldn’t be able to get a clear text version of the user name, which is something that you may well need to do.
The best way to strengthen the security on your login credentials is to use a stronger (ie slower) salted hash algorithm on your users’ passwords, such as bcrypt or PBKDF2.
See http://codahale.com/how-to-safely-store-a-password/