&gt; Use https. And don&#x27;t do client-side hashing, it&#x27;s no improvement.<p>Well, it&#x27;s an improvement if your users are reusing their passwords. Then multiple different sites will have different hashes sent.<p>But that&#x27;s all besides the point, we should&#x27;ve been using zero knowledge proofs for authentication since the beginning.