Background:
I am building a website more or less for me and myself and wanted to try something out.
No login name. Just a password to login.
So I take a user registration and use php's password_hash() and save that to the db.
(for non-php-natives: this function returns a string encompassing algorithm, salt & hash back)
But that poses a weird problematic when someone wants to login.
I want to use the php function password_verify(\$password, \$hash) to verify the login.
The problem: As I dont have a username for finding the hash from the db,
(select password from users where ?
)
I can:
- get and check every password in the database for the correct one. (no)
- or generate something like a username -> a second hash (unsalted this time) which is small and fast (adler32?) and use it to find the real hash(es) for verification checking.
How easy would it a be for an attacker, if my db got leaked, to find out the password from the hashes?
Is there a better algorithm than adler32, that has maybe more collisions or has a smaller output?
TLDR:
can someone take a good guess at a password, with an adler32 hash of that password?
can someone take a good guess at a a password, with 2 hashes of the same password? (of which one is hashed with adler32)