My understanding of hashing is conceptual at best and I'm assuming things that I'm not sure of and it leads me to a question that I don't even know if it's founded or not. So please correct my statements below if anything is wrong.
The hash for a given string has a definite length and there is an infinite number of original string that can give the same hash. An example of hashing function I heard of would be modulo 5. So if an user has a password which is 6, then 11, 16, 21 and so on will also log the user in.
I'm assuming (probably wrong though) that practically the strings that give the same hash will be really far apart. Say the original password is :
The "second" string that would fall in this bucket would be a bit longer than the entropy of the hash itself. Something like :
So impractical that the collisions doesn't really matter since nobody would use a password like the second one and let's not even talk about the third collisions .
So my question is :
If the hash can be seen as modulo 5, what stops someone from just saying that if the value in DB is 1 then the most likely value is 6 since 11, 16, etc are impractical ?