The logic through the system is for actually hashing a password is a little strained, and I'm not sure if it's obviously secure or not: psuedo steps: 1.) Ge

The logic through the system is for actually hashing a password is a little strained, and I'm not sure if it's obviously secure or not: psuedo steps: 1.) Get a master password from the user 2.) Get an email from the user 3.) Call makeKey(masterPassword, email) where makeKey is 5000 rounds of pbkdf2(masterPassword, email) with a resulting 256 byte hash. Seems weird to use the email as a salt rather than random bytes. 4.) Take the result of makeKey and call pbkdf2(masterPassword, hash) for 1 round and resulting in a 256 byte hash. So a 256 byte key is created from the 'master password' and email (as salt) with 5000 rounds of pbkdf2. Then the result is used as a salt for a single round of pbkdf2 of the 'master password' again. It just seems odd to use the master password to create a hash, then rerun the same hash algorithm with that hash as the salt.