title: Is this security concept suitable for a web app?
body: <p>I wondering whether the following security concept is suitable for a web app:</p>
  
  <p>1) Login UI availabe only over SSL.</p>
  
  <p>2) Login UI consists with 3 fields:</p>
  
  <ul>
  <li>List item</li>
  <li>User name,</li>
  <li>File upload box,</li>
  <li>Pin field. </li>
  </ul>
  
  <p>File for upload box is <em>emailed to user during registration process</em>.</p>
  
  <p>This file is a long sequence (few kilobytes or few dozens of kilobytes) of random bits.
  This file scrambled using pin value, than its hash like SHA-512 calculated in an multi-layer manner, like so - many times calculate the hash, appending or prefixing the hash from previous iteration to last processed blob.</p>
  
  <pre><code>F(n) IS (
      IF n == 0 
      THEN HASH(SCRAMBLE(file, pin)) 
      ELSE HASH(IF n mod 2 == 0 THEN CONCAT(F(n-1), FILE) ELSE CONCAT(FILE, F(n-1)); 
  </code></pre>
  
  <p>Pin is displayed during registration on screen as image, so this pin is ONLY displayed on screen, but never transmitted to user as plain text.</p>
  
  <p>Is this enough secure?
  Thanks for comments.</p>
  
  <p>Possible contexts or types of web apps:
  a) business website (with payments processing in behalf of site owner).
  b) intranet or corporate website with access to a special section for customers.</p>