Yup, the future is clearly client side hashing.  I wonder if we could get the latest and greatest from that field built into the next jquery etc so people become more likely to use the routines.  ...<p>That said states like Iran might be more likely to garner the most passwords through sniffing, which is a passive activity, than hacking the sites that store passwords insecurely.