alt Hacker News> Whenever I've written authentication, passwords are hashed on the client side and never transmitted in the clear.
Don't assume everyone coding a login page is as competent as you though...sadly.
Replies
encom • today at 4:23 PM
But the sites where I actually care if my account gets compromised - Steam, FastMail, DigitalOcean etc. - are very unlikely to screw up password storage.
I'm never going to bother with paranoid security inconveniences for the crappy website my local pizza place uses.
The mechanism proposed by the GP is not competence. It's a well-known vulnerability called "pass the hash".