Hacker News Reader

No reason the server can’t provide a nonce for the login to salt the hash.

Now the server has to store the password in plain text so it can rehash with the new nonce every time.

And how would the server know the desalted hash?