I must confess to being largely ignorant on most of the high-tech security issues relevant for web applications, but there is one thing I at least thought I could ask because it
How about:
Salt = CryptoHash( CryptoHash(SubmittedEmailOrUsername) . CryptoHash(SubmittedPasswd) ) ?
That would seemingly
while still having good entropy (hash-based instead of plaintext), and
provides a salt that's as long as a cryptographic hash eg 128-512 bits?
One problem would be if the system allowed two user to have the username and password (wouldnt happen with email addr though), but are there any other problems with this scheme?