> should have called pass secr. instead. Even if you used a pre-hashed (well, preferably key derived using scrypt, argon2, etc) password, the problem is that i

> should have called pass secr. instead. Even if you used a pre-hashed (well, preferably key derived using scrypt, argon2, etc) password, the problem is that if an attacker dumped your database they can still login to every account on your system without the original password. To perform a full challenge response system, you'd need to get some public key crypto going, be that deriving ed25519 keys on the client or going to a full PAKE algorithm like SRP. Anything short of that means your challenge response is going to prove almost as bad as clear text if an attacker steals the secrets.