So lets's say that a user wants to register to some website. For whatever reason, I want to not allow that password if it is one of the top 100 passwords used on my site (So I'm not checking against just a top 100 dictionary, but one specifically for my site). However, all of the passwords on my site are hashed and salted. How can I check which passwords are in the top 100 most used in the most efficient and secure way? The only thing I can think of right now is storing just the hashes of every password and how many users registered with that password in a separate table. That way the attacker wouldn't be able to attach the password hash to the username and all they have is the unsalted hashes of the top 100 most used passwords. Is there a way to do this in a more secure or efficient manner?
Unsalted hashed passwords, especially hashes of common passwords, are trivial to reverse. For example,
diamond is a top 100 password. A quick Google of its SHA1 hash of f872caad177d67bbe18c119d0505f2d3caa02af3 quickly reveals the unhashed password.
If a list you created a list that indicated that a set of users all shared the same password and that list was acquired by a hacker, then a password breach of one account would quickly lead to a breach of other the accounts.
This also opens up a new type of attack where an attacker can guess the top 100 passwords for your site by setting their account's password to likely choices. When it fails, they'll know they've found one. Then they can try logging into other user's accounts with that password.
Basically, storing passwords securely is difficult. The current technologies have been developed over decades. Any change you make to the current model will likely risk your user's accounts and passwords.
If you want, grab the list of the top 100, or top 1000, passwords and prevent them from being used. Just keep in mind that there is much controversy over the use of password requirements. Some feel they make things more secure, others that they just irritate users.