You need to ofc 'salt' customers passwords in advance of hashing them to stop being able to Get well the original password from the hash. $endgroup$ I do not understand how this at some point played out, but a number of months ago there was speculation that someone had experienced his