[dredmorbius]

But you're making the mistake of assuming they're hashing passwords at all ;)

That, I think, is the correct inference.