your domain will spit out hashed passwords. Any authenticated user can request password hashes for any domain