I would like to implement a lockout mechanism that not only protects against same username and many passwords attacks, but many usernames and same password attacks too.
To implement this I figured I need a table to store every entered password that caused a failed attempt. Then, at every login attempt, I check if there was a failed login attempt with the same password.
All the passwords that belong to user accounts are encrypted with bcrypt, have a salt, high cost and all the rest of it. But I can't encrypt the passwords used in a failed login attempt like that, can I? I can't do a lookup with MySQL using the WHERE clause because every time a password is rehashed, the value differs from the previous hash even if it is the same password.
To be able to do a lookup with MySQL using the WHERE clause I figured I need to store the passwords in the failed login attempts table in a less secure way, like SHA512. I know that some passwords entered in a failed login attempt could belong to a user account. So, is it safe to store the hashes in this format in order to be able to check for failed login attempts? Or is there a better way to achieve this?