> You can say "well that's their fault for mucking with the input to bcrypt" but I bet most people would believe that kind of operation was safe before it's explained to them why it's not.
What makes you think this foolish developer would not do the exact same thing before sending the data to an externally hosted auth service?
What makes you think this foolish developer would not do the exact same thing before sending the data to an externally hosted auth service?