One problem with passwords is that if they can be broken as follows:
- pick a random password
- hash it
- compare that hash to other known hashes
This way, you have broken the password. Then if you can access the hash of a password, you can reverse-engineer it to find out the password.
However, isn't this easily fixed by tying the password to the user name?
Say my username is my e-mail: firstname.lastname@example.org and my password is password123.
All the company needs to do under the hood is make my actual password include my username in a randomized way, that is, my actual password is
papLusswtOordpLanEt123@hotmail.com. Basically, what I did there was just take
password123 and throw in letters from my username at random places.
Now this is the password that I hash and store in my database. Now if anybody ever finds out what password led to this hash, they will know it is
papLusswtOordpLanEt123@hotmail.com, but that is NOT my password, and they don't know how to extract my password from it, since the mixing of passwords and username was random.