They can't even be used as an ID. They can be used to "verify" an id (weaker than a password, but maybe good enough to eliminate an impersonator), but not to SELECT $person FROM all_users