It's an idea roughly analogous to SRP, which is well-studied. Share a key, then later prove you still know it.<p>Client-side hashing would be great, if there was a way to do it that didn't involve Javascript.