I'm curious, how is half-hashing the password different from really hashing it? The best protocol I know of is to derive a signing keypair from your (salted, s

I'm curious, how is half-hashing the password different from really hashing it? The best protocol I know of is to derive a signing keypair from your (salted, stretched) password, and store the public key on the server instead of a password hash. Then during login, the server sends a challenge to the client, and the client signs it. The server never sees any secret material at all. Keybase uses a version of this protocol. Unfortunately all the magical client side crypto in the world doesn't save you if the attacker can compromise your server and then send clients bad JS :p