Password reuse is extremely common - if someone is able to get access to user’s password on a social networking site, it can be used to compromise his data stored on (say) email service. If a user is accessing a web service over SSL, only the user [or user’s browser to be precise] and the web service gets to see the password. (even from an external network) One-way hash (best choice) One way hash has the property that one can verify whether the user knows the password or not without actually storing the password itself.