Comment by tchebb

> you're doing a fake password hash to obscure timing, remember that it's fake and don't let the user log in

That would be a much better approach. I see your point now.