I have a project where I need to do an account merge across two websites.
Some percentage of users have accounts on both sites (same email address). Rather than just assume that two accounts with the same email address are the same identity, we'd like to go one step further and compare password hashes.
Both websites are on the same eCommerce platform, just 2 differently branded sites which we're consolidating into one. The hashing function is the same on both sites (SHA256) however we use different SALT's on each site.
password(1) = hello
salt(1) = abc123
hash(1) = 1a1A1a1A1a1A
password(2) = hello
salt(2) = xyz456
hash(2) = 2b2B2b2B2b2B
Given just salt(1), hash(1), salt(2), hash(2), is it possible to verify that that password(1) and password(2) are the same? i.e I don't need to decrypt, just need to confirm that the two passwords are the same?