title: Node.JS Crypto.HMac generation for passwords
body: <p>Just was following a tutorial on how to store passwords in a database. they use the following to generate the hashed password:</p>
  
  <pre><code>hasher.computeHash = function(source, salt) {
      var hmac = crypto.crypto.createHmac("sha1", salt);
      var hash = hmac.update(source);
      return hash.digest("hex");
  };
  </code></pre>
  
  <p>For what ever reason I am getting confused as when ever I have looked into Password Cryptography I always used a secret which I appended to the salt, but I can't find any resources out there which do this... What I mean is:</p>
  
  <pre><code>hasher.computeHash = function(source, salt) {
      var saltNHash = salt + "super Secret LOOONG string!!";
      var hmac = crypto.crypto.createHmac("sha1", saltNHash);
      var hash = hmac.update(source);
      return hash.digest("hex");
  };
  </code></pre>
  
  <p>Is this a bad approach?
  Is there a better way of doing cryptography (storing passwords in a database) within a node module?</p>
  
  <p>Thanks, Sorry if duplicate, I've looked around but I don't think I know the right keywords to google.</p>