I use a method like that, but the result of that step then goes through PwdHash (whose code is small enough to inspect for naughtiness) so that multiple web sites wouldn't expose the scheme.