I'm not a security person - you're saying hashing is useless because an attacker could capture passwords before they were hashed? I think maybe you're over-thi

I'm not a security person - you're saying hashing is useless because an attacker could capture passwords before they were hashed? I think maybe you're over-thinking things. There have to be compromises that don't involve getting access to the whole system - plus even if an attacker does have full access, how likely is it that they're going to try to capture pre-hashed logins versus just dumping the auth db? As far as I can see, hashing provides clear value over not hashing, so there's no excuse not to do it.