security - Password hashing with true random salt or username salt plus pepper? -

consider following 2 methods:

hashedpassword = hash(trulyrandomsalt + password) 

where hashedpassword , trulyrandomsalt stored in database.

hashedpassword = hash(applicationconstantpepper + uniqueusername + password) 

where hashedpassword , uniqueusername stored in database , applicationconstantpepper stored in application config. here, uniqueusername acts salt email addresses.

i have read question has lot of great information doesn't address application constant pepper value , how improve using usernames salt.

i have used method 1 32 bit cryptographically random salt. however, i've seen method 2 used in application. first issue have method 2 ties username hash username can never change without regenerating hash.

what security issues method two? best method use?

consider following 2 methods:

the first method terrible because allows attackers hashes use oclhashcat make, typically, trillions or quadrillions of guesses per month, , second horrific because same attackers can not make same, typically, trillions or quadrillions of guesses per month, if ahold of applicationconstantpepper , usernames before ahold of passwords, can precompute guesses while work on getting passwords.

please read how securely hash passwords?, in thomas pornin states "for peppering applicable, need in special setup there more pc disks; need hsm." please read entire article context, gist of is:

• do use pbkdf2 (also known rfc2898 , pkcs#5v2), bcrypt, or scrypt.
• do not use single pass of hash algorithm, regardless of how seasonings are.
• do use 8-16 byte cryptographically random salt.
• use high iteration count/work factor machine can handle @ peak load without causing users complain.
• for pbkdf2 in particular, not request or use more output bytes native size of hash function.
  • sha-1 20 bytes
  • sha-224 28 bytes
  • sha-256 32 bytes
  • sha-384 48 bytes
  • sha-512 64 bytes
• if you're on 64-bit system, consider using pbkdf2-hmac-sha-384 or pbkdf2-hmac-sha-512, reduce margin of superiority attacker 2014-vintage gpu's have on you.

if pepper concept anyway, please read password hashing add salt + pepper or salt enough?, again, thomas porrin's answer in particular.