As any good password storing developer I have user unique salts that I use to generate password hashes. ie I store a uniquesalt
and SHA1(salt + password + "applicationuniquestring")
in the database for each user.
If someone were to get my database they could theoretically create a rainbow table for every user and have at it until they crack it.
But what if I didn't store the last two characters of the generated hash.
Con: This would make the chance of a wrongly entered password being accepted higher (but probably not so high that I really care).
Pro: It would also make it pretty annoying to try to get the password back as what ever you do there are ((26 + 10) * (26 + 10)) = 1296
possible endings to the hash you don't know.
And if you were to try to guess and brute force all those combinations back and try the different combinations.. well even a poorly coded service should flag you after about 100 failed login attempts...
Now this might be stupid for many reasons but I cant think of them now.. Now please chainsaw this idea before I implement it.