Currently my project still uses MD5 hashing to encrypt passwords. Yeah, I know.
I'm planning to update the password system to use the newer
password_verify functions in PHP, which will improve the security of the users' passwords.
However, my moderator team has voiced a concern: since one of our core rules prohibits users from having more than one account, they need ways to tell if two accounts belong to the same person. One such way that they have used is to check if the MD5 hashes are the same on the two suspect accounts - if so, then the accounts have the same password and suspicion intensifies. But with the proposed new system, this will no longer be possible because different hashes will be produced on the two accounts.
In the interest of finding a compromise, is there any way to use the better security of
password_hash, while still providing a way for the moderator team to detect when two accounts share the same password?
My thoughts at the moment involve hashing the password in some other way that will produce the same hash for the same password, but I'm worried that this will re-introduce the same vulnerability that we're trying to escape by moving away from MD5. Are there any options here or will I have to use Executive Decision Power to overrule the concern?