You&#x27;re wrong because it&#x27;s a strawman since if an attacker can intercept the hash they could as easily intercept the plaintext in your traditional server-side architecture.  The attacker cannot replay a TLS unless there is a problem with it, there have been many issues in TLS stacks, but it&#x27;s the most widely deployed.<p>Furthermore, using plaintext any further from the owner or exposed longer than is necessary is inherently less secure because your breach of https would also compromise users&#x27; passwords.