> You should always hash the pwd client-side first... wtf ? This is very rare. What production systems do you know of that use SRP or similar mechanisms? As fa

> You should always hash the pwd client-side first... wtf ? This is very rare. What production systems do you know of that use SRP or similar mechanisms? As far as I know the vast majority of companies and applications use server side hashing.