I was researching about hash, and I thought, If sites store passwords with hash algorithms, then can't this happen:
- User A has the password 'hello'
- User B finds out the hash code of the password of user A
- User B knows the username of user A and uses hash collision to find a string with an identical hash
- User B logs in the account of user A
So now, my main question is: Do databases store the hash of the password or not? And if they do so, can the thing I wrote above happen?