I was thinking about the recent (seemingly weekly) security breaches we've seen where millions of password hashes have been leaked and I was wondering how one might secure their site against a password dump, even if a hacker found a SQL injection vulnerability.
What if the user the website was using to log into the database had more limited permissions. Let's say on all non-critical data the user had full permissions like normal (CRUD). But what if the user was denied all CRUD operations to the table that stored the login hashes, security questions, etc, and could only run stored procedures on that table. And let's say those stored procedures never returned the password hashes to the application layer, but rather you would pass the hash to the procedure and the procedure would return a boolean value indicating whether there was a match.
It seems to me that this setup would eliminate the possibility of a password hash dump through SQL injection entirely. Does this setup provide additional security, is it advisable?
Please see this question for more details: