Hacker News Reader

> Whenever I've written authentication, passwords are hashed on the client side and never transmitted in the clear.

Don't assume everyone coding a login page is as competent as you though...sadly.

The mechanism proposed by the GP is not competence. It's a well-known vulnerability called "pass the hash".

But the sites where I actually care if my account gets compromised - Steam, FastMail, DigitalOcean etc. - are very unlikely to screw up password storage.

I'm never going to bother with paranoid security inconveniences for the crappy website my local pizza place uses.

Reply on news.ycombinator.com