2 ms·
Most people wouldn't do that because it's effectively redundant if you trust TLS and that the server is not compromised. However I think your proposed technique
by smolder 7y ago
Most people wouldn't do that because it's effectively redundant if you trust TLS and that the server is not compromised. However I think your proposed technique would be useful in cases where TLS is broken or the server is in some way compromised, running on low trust hardware, etc. So it's a good precautionary measure.
Grandparent is also right that your users password can still be compromised on other services, giving an attacker a way into your own. Password managers don't have that problem.