How will they be able to login with the hash without modifying the application? If that's the case, they'll also be able modify (or force to author to modify) t

How will they be able to login with the hash without modifying the application? If that's the case, they'll also be able modify (or force to author to modify) the system to login without the password, so it's irrelevant to request the password.