When a user changes password, I'd like to implement a simple check that prevents them from reusing the same password. If the new password matches the old password, reject with an error.
Sounds easy, but at the same time I'm aware that hashes can collide. So in theory it's possible for password
secret1 and password
secret2 to both result in the hash
In this case, the user could legitimately choose a different password, and the application would reject it because it thinks it's the same password. I understand this is a very unlikely, but possible, situation.
In light of this, how is this kind of thing normally implemented?