I always understood that servers don't actually store user passwords. Instead, they store hashes of passwords and then they validate the user input by applying the hash function, then compare the hashed result to the hash value stored locally at the server. Without receiving a password and then applying this hash-and-compare operation, a user doesn't get access.
If this is the case, how can thousands of Yahoo account passwords be stolen, as reported recently?
If this is not the case (as to how Yahoo password authentication is done), then how is it done? Do they really keep the actual passwords on hand? Is this common practice?