title: VB.Net Password Hashing practices
body: <p>I'm trying to secure a website that is being moved to a public server soon.  I've just finished adding the password hashing functions to all of my login scripts.  I'm using <code>FormsAuthentication.HashPasswordForStoringInConfigFile(pw, method)</code> to do so.  I have a question about the process I'm using and whether or not it's secure for a web server:</p>
  
  <ol>
  <li>Password is sent in plain text over HTTPS to the server</li>
  <li>The server looks in the Users table to find the user's Salt (several random characters) and their hashed and salted stored password</li>
  <li>The plain text password is appended with the Salt</li>
  <li>The new string is hashed using the above function</li>
  <li>The newly hashed version is compared to the stored version</li>
  <li>If equal, login is allowed</li>
  <li>If not equal, the login attempt is logged in Session variables, up to 3 times before locking out the user's machine from accessing the login page until an admin verifies IP address and unlocks.</li>
  </ol>
  
  <p>Does this look about right?  I just don't see how the salt is effective in this method...  Anyway, all I've done is add a salt and hash.  Is this considered Encryption? Or am I missing a step? I remember reading that hashing algorithms like SHA1 and MD5 are not encyption algorithms, so what else needs to be done?</p>