Is there a way to ensure that a password generated (hashed) for a user can only be used / associated by that user?
In other words I want to prevent:
- Hashed password is stored in the DB for user "a".
- Someone with DB access overwrites the hash for "b" with that of user "a".
- User "b" must now log in with the same password as "a".
I understand that users CAN have the same passwords if they happen to create it with the same value. I want to try and prevent the above scenario. Was thinking about the possibility of using the username as part of the password hashing / verification process.