> single long password could be used to authenticate as anyone.
Only if everyone uses the same long prefix for password.
Only if everyone uses the same long prefix for password.
bcrypt(longpassword + 123456 + me@foobar.com) = bcrypt(longpassword) = hash1 -> true
If they then try login as you@bar.com using same password there would be a cache lookup:
bcrypt(longpassword + 1111111 + you@bar.com) = bcrypt(longpassword) = hash1 -> true