• towerful@programming.dev
    link
    fedilink
    arrow-up
    10
    ·
    11 months ago

    Client side hashing of a password just makes the hashed result the password, as far as security is concerned.
    Unless there is some back-and-forth with the server providing a one-time-use salt or something to make each submission of the password unique and only valid once, at which point that might get snooped as well.
    Better off relying on client certificates if you are that concerned