This is an interesting idea. I think you could take it a little further though.<p>How about databases explicitly disallow direct comparison or materialization of any field named &#x27;Password&#x27;, &#x27;Passwd&#x27; etc. I&#x27;m aware that this would be a breaking change, and would require overrides to support legacy software. That said, the defaults would lead developers to a secure by default mindset. If n00b dev1 realizes that s&#x2F;he can&#x27;t store a password and get it back again, they go looking for why and find that the only way is to call something like:<p><pre><code>  SELECT IsPasswordValid(Password, @Password) FROM Users
  UPDATE Users
  SET Password = StorePassword(@Password)
</code></pre>
Edit: I realize that there are security issues with the suggested sql. A PAKE is probably necessary.