Ok but how do you associate Hash2 with a user account when the user logs in?
login(username, password)
User = GetUser(username)
Hash1 = Hash(User.Salt + password)
Salt2 = BlindHash(Hash1)
Hash2 = Hash(Salt2 | Hash1)
return Hash2 == User.HashWhat is the security benefit of sending you the actual hash of the password? Why not just the hash of a unique user token?
It's important to use the password as part of the entropy so that an attacker has to make a Blind Hashing request for each attempt to crack a password versus being able to make a single request to effectively unblind it.