> The description leads off talking about the grave privacy implications of storing scrypt password hashes. But then it stores what is in effect an scrypt passw

> The description leads off talking about the grave privacy implications of storing scrypt password hashes. But then it stores what is in effect an scrypt password hash on the server. I don't think it's saying that storing the hash is bad, it's saying that sending an unmodified password to be hashed on the server is bad since that server now has your cleartext password.