Is this algorithm secure? I recently found this site, proposing a hashing algorithm for passwords.

They describe the following:


pad the password on both sides with SHA1(email) to 4 * length(password)
HMAC(padded password, global salt)
choose a random salt of 22 characters
bcrypt(hmac, salt)


Is this algorithm secure? I think it might be a security flaw to pad the password on both sides with the same text, and I see no point in using a global salt and a salt which is chosen randomly for every password.
Points 3 and 4 are a secure way of storing the input to bcrypt (with appropriate choice of parameters for bcrypt).

Points 1 and 2 aren't necessary but don't harm:


they would add a small amount of extra computation for an attacker is possession of the password database that wants to do a dictionary attack;
the attacker wouldn't be able to straight-out use a standard cracking tool as it is a custom scheme, they would need to modify existing tools or develop their own.