0

When a user changes password, I'd like to implement a simple check that prevents them from reusing the same password. If the new password matches the old password, reject with an error.

Sounds easy, but at the same time I'm aware that hashes can collide. So in theory it's possible for password secret1 and password secret2 to both result in the hash 9e72a....

In this case, the user could legitimately choose a different password, and the application would reject it because it thinks it's the same password. I understand this is a very unlikely, but possible, situation.

In light of this, how is this kind of thing normally implemented?

Improve this question
4
  • 4
    This is overwhelmingly unlikely to the point of being a non-issue. Also case in point, if X and Y have the same hash, then the user can also log in with both passwords.
    – user163495
    Mar 16 at 9:16
  • 2
    What hash function do you use? For getting one SHA-1 collision Google had to a large number of their cloud services calculate for several months to find one collision. Therefore the chance that you find a collision by hashing passwords using SHA-1 or larger is next to zero. Even with MD5 I am not sure if you manage to find one collision in the space of passwords.
    – Robert
    Mar 16 at 9:16
  • @Robert I'm using bcrypt.
    – Gigi
    Mar 16 at 9:30
  • Brypt can be used with different hashes, starting with MD5. You can identify the used hash by the prefix in the created output: en.wikipedia.org/wiki/Bcrypt#Versioning_history
    – Robert
    Mar 16 at 10:39

1 Answer 1

Reset to default
6

This is not something to be afraid of, but to welcome. If you use a cryptographically secure hash function, and you are lucky enough to experience a collision, you start documenting everything and start preparing your papers for conference talks. You'll be famous.

To answer your question directly, using a cryptographically secure hash function is the way to avoid collisions. It is so unlikely that a collision will happen that you do not need to account for it.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.