I should update the article — lately I’ve switched to bcrypt.

It can be tuned to be as secure as you want (i.e. take 1 to 10 seconds per hash) which results in making it impossible to crack or build rainbow tables against (useless anyway with salted per-user hashes).

Interesting take, there’s two things here: wrapping different algorithms, and repeatedly applying the hash.

‘Wrapping’ the hash functions in most cases only provides a marginal increase in security. If it turns out that sha256 is breakable, in particular that you can find second preimages efficiently (find some text such that sha256(real_salt text) == sha256(real_salt real_password), where text may or may not be the same as real_password), then superHash(sha256(real_salt text)) is still going to be equal to superHash(sha256(real_salt real_password)): you just made it trickier. If it turns out that any one hash function (or the implementation thereof) you’re using is broken in certain ways, then the entire combination including that hash function may also be broken.

If you in fact did sha256(sha1(…)), you really only have a sha1 hash: the output of a 256bit hash when given 160bits on input is really only 160bits, in the same as if you pick a really long password out of a preexisting list of a couple hundred really long passwords.

‘Repeating’ a single hash function on the other hand is a good way to require an attacker to work much harder. However, Shanti already did a good job explaining that in the article :p

Supported algs by php5:
[0] => md4
[1] => md5
[2] => sha1
[3] => sha256
[4] => sha384
[5] => sha512
[6] => ripemd128
[7] => ripemd160
[8] => whirlpool
[9] => tiger128,3
[10] => tiger160,3
[11] => tiger192,3
[12] => tiger128,4
[13] => tiger160,4
[14] => tiger192,4
[15] => snefru
[16] => gost
[17] => adler32
[18] => crc32
[19] => crc32b
[20] => haval128,3
[21] => haval160,3
[22] => haval192,3
[23] => haval224,3
[24] => haval256,3
[25] => haval128,4
[26] => haval160,4
[27] => haval192,4
[28] => haval224,4
[29] => haval256,4
[30] => haval128,5
[31] => haval160,5
[32] => haval192,5
[33] => haval224,5
[34] => haval256,5

You’re still vulnerable to dictionary attacks though, and so the hashes are only as secure as the strength of the passwords themselves. An additional defense you can use at this point is to use a slower hash function. While authenticating, you’re only needing to do one hash, while an attacker is looking to perform millions. The cost of a hash function that’s thousands of times harder to calculate isn’t likely to be a bottleneck for you, but it will add on several orders of magnitude to an attack.