You Might be on position re: info leakage and this should be an essential consideration for anybody rolling their unique authentication/authorization plan. +one for mentioning OWASP. Armed with employee passwords, hackers can masquerade as authorized customers and waltz suitable previous safety controls. Hackers can obtain account credentials as a result http://pigpgs.com