Henry Wright gave a good explanation, that is the exact same way that I implemented user password and validation on my php classifieds website, which used to be a wordpress site. Can buddypress work easily with a PHP website that is not wordpress-based? It would be a cool feature to add.
