How is hashing on the client and sending it to the server any secure? If I read you right, you are essentially trying to say that that's enoug protection against wire sniffing and the hash can be send in clear text?!
If you send just the hash, the hash becomes your password! Everyone who sees the hash on the wire can afterwards log themselves into your account, how the fuck is that supposed to make anything secure?

Send the password, hash on the server. Let TLS take care of sending the password securely to the server and don't try to invent any pseudo "secure" protocols that aren't secure at all.


And again, because somehow that doesn't seem to stick: Hashing is not the same as encryption! A hashed password is NOT an encrypted password.


Shitlord by trade and passion. Graphics programmer at Laminar Research.
I write blog posts at feresignum.com