You're On point re: facts leakage and this should be an essential thing to consider for anyone rolling their own personal authentication/authorization scheme. +one for mentioning OWASP. Armed with personnel passwords, hackers can masquerade as licensed consumers and waltz ideal earlier security controls. Hackers can get hold of account qualifications http://pigpgs.com