Background:
II am building a website more or less for me and myself and wanted to try something outa scheme where there is no username; just a password to login.
No username. Just a password to login.
So
So I take a user registration and use php's password_hash()PHP's password_hash() and save that to the dbDB.
(for non-php-natives: this function returns a string encompassing algorithm, salt & hash back)
But that poses password_hash() returns a weird problematic when someone wants to login.
I want to use the php function password_verify(\$passwordstring encompassing algorithm, \$hash) to verify the loginsalt & hash.
The problem: As
The issue is that as I dontdon't have a username for finding the hash from the db,
(select password from users where ?)
I canDB.
To work around this it is possible to:
- get and check every password in the database for the correct one. (no)
- or generate something like a username -> a second hash (unsalted this time) which is small and fast (adler32?) and use it to find the real hash(es) for verification checking.
- get and check every password in the database for the correct one (but I don't like this workaround);
- generate a second hash over the password (unsalted this time), this hash is small and fast such as adler32 and use it to find the real hash(es) for verification checking.
How easy would it a be for an attacker, if my db got leaked, to find out the password from the hashes?
Is
Is there a better algorithm than adler32, that has maybe more collisions or has a smaller output? What
What if I force my users to a 40+ char password?
TLDR:
can someone take a good guess at a password, with an unsalted adler32 hash of that password?
can someone take a good guess at a a password, with 2 hashes of the same password? (of which one is hashed with adler32)
