That's something I've wondered - do password hashes tend to be the same across platforms? Is everyone using the same hashing algorithm? Isn't this also what salting is for?
Never implemented auth myself.
Never implemented auth myself.
But mistakes such as salting with just the username are sometimes made even by very large companies and in that case, hashes could be the same.
That only tells you the passwords are the same.
You can do this anyway. But the space requirements of a rainbow table are so large that including an account's username in the password would make a rainbow table completely unfeasible.
Salts are there to ensure that two accounts on the same website which have identical passwords nevertheless have different password hashes.