2 ms·

Also it would defeat the purpose of having passwords hashed, because a data leak would then expose people's account just as if you were storing the plaintext pa

Also it would defeat the purpose of having passwords hashed, because a data leak would then expose people's account just as if you were storing the plaintext password.

mbrubeck 17y ago
At the one place I worked where this was actually implemented (spoof a user by entering a hashed password), it only worked from inside the firewall, to mitigate this risk. According to the interview, Facebook has similar restrictions on user spoofing.