If the users choose the same password (by coincidence) then no matter what hashing algorithm you use the same password is still the same password.
The only way around this will be to check each time someone registers or changes their password that the password is checked against a database of passwords (baaad) or if you use a hashing algorithm that doesn't use different salts/peppers etc. for each password (again, baaad).
Ultimately, and this is one of the many reasons a password complexity policy should always be required so that you minimise the potential risk of people creating the same password.
I.e. If you don't permit your staff to create easy passwords like "Password1" but require them to enter capital letters, numbers, symbols then the chances of them entering the exact same password are reduced - not eliminated because someone could easily do, for example "Password123!".
Hashing only protects the data stored in the database because the server takes the details entered by the user -> retrieves the hash, the salt (and the pepper if either are used) -> runs the details entered and obtained from the DB through the algorithm -> if the result compares to the stored hash then the details are correct and lets the user in. This is only to verify the details - nothing to do with what the user enters and chooses the set their password. Salt and peppering just allows the hash to not be duplicated elsewhere in the database (i.e. if two hashes are identical then the password will be the same for both accounts - baaad).
As other answers have said, the best solution is multi-factor (more than one of the following, but not more of the same factor) authentication:
- Something you have -> a smart card, RSA generator etc.
- Something you know -> The password or PIN
- Something you are -> biometric (fingerprint, retina etc.)
E.g.
- Smart card + Password = Good
- RSA generator + Password + Fingerprint = Good
- Password + PIN = Bad
Isn't that brute forcing in the first place? Also maybe Cloud Flare has a mechanism to prevent this as it apparently prevents DDoS attacks. And I don't think a normal user would do this as most users would just click "Remember my Username and Password on this site". – NeVMiku – 2016-07-27T09:08:41.487
1You can use 2-way auth, password + OTP or password + RSA ID. – manjesh23 – 2016-07-27T09:10:19.403