title: Flow of validating a user with hashed password?
body: <p>I was reading this <a href="https://crackstation.net/hashing-security.htm#aspsourcecode" rel="nofollow">article</a> about hashing passwords when I came to this part:</p>
  
  <p>To Validate a Password</p>
  
  <ol>
  <li>Retrieve the user's salt and hash from the database.</li>
  <li>Prepend the salt to the given password and hash it using the same
  hash function.</li>
  <li>Compare the hash of the given password with the hash from the
  database. If they match, the password is correct. Otherwise, the
      password is incorrect.</li>
  </ol>
  
  <p>But I am a little confused with the flow this would follow, for example lets assume I have a database with a user table with id,name,password and email and in order to login to some app I need to input my email and password.</p>
  
  <p>Following the the steps above, I first need to get the salt+hashed password of said user stored in the database.</p>
  
  <p>Question:</p>
  
  <p>Assuming I am using a simple stored procedure would the only way be to do it like this...</p>
  
  <pre><code>    CREATE PROCEDURE [dbo].[sp_validate_user]
  
  @us_email VARCHAR (MAX)
  AS
  BEGIN
   -- SET NOCOUNT ON added to prevent extra result sets from
   -- interfering with SELECT statements.
   SET NOCOUNT ON;
  
      -- Insert statements for procedure here
  
  SELECT  us_id,
          us_name,
          us_pass,
          us_email
  
  
   FROM  Users
   WHERE us_email = @us_email
  
  END
  </code></pre>
  
  <p>Then following step two and three:</p>
  
  <pre><code>    public static bool ValidatePassword(string inputPassword, string storedPassword)
      {
          // Extract the parameters from the hash
          char[] delimiter = { ':' };
          string[] split = storedPassword.Split(delimiter);
          int iterations = Int32.Parse(split[ITERATION_INDEX]);
          byte[] salt = Convert.FromBase64String(split[SALT_INDEX]);
          byte[] hash = Convert.FromBase64String(split[PBKDF2_INDEX]);
  
          byte[] testHash = PBKDF2(inputPassword, salt, iterations, hash.Length);
          return SlowEquals(hash, testHash);
      }
  </code></pre>
  
  <p>My concern comes from the fact that if I am creating objects with the data pulled from the table, doesn't that make the information within vulnerable somehow?</p>
  
  <p>Also does that mean that the only way to use this validation is pulling all the user's information based only on a username/email just to check in runtime if the input password and the hashed one match and then letting said user access the information?</p>
  
  <p>I'm sorry if this sounds confusing but any insight would be great. </p>