[Toshio]

> "If an employee or a cracker has access to the user database, doesn't he already have the user data?"

You sound like you may not be aware of how attacks happen in real life.

Most of the e-mail addresses that people sign up with are either yahoo or gmail. Most people are lazy and choose for this third-party site the same password from their yahoo or gmail accounts.

If the passwords are in plain text ... well ... then people's yahoo and gmail accounts are at risk.

Recently, yahoo notified me that someone has been trying to brute force my yahoo mail password. Luckily I use a different password on third party sites, but the thought of someone taking over my e-mail account was rather scary.

[irahul]

You do realise I said the same thing?

[bernatfp]

Do you realise the OP said the same thing?

[irahul]

"Hashing password is mandatory because user data can be compromised" is not the same as "Hashing passwords(preferably salted) come into picture only when user data is already compromised"