That's why you don't hash it, you encrypt it. What they want to do here can be solved using something called channel binding. The problem is not that we can't

That's why you don't hash it, you encrypt it. What they want to do here can be solved using something called channel binding. The problem is not that we can't do this securely, it's two separate but related problems: 1. The web stack was never designed for RPC and attempts to use it that way are often unsafe. 2. Poor or missing libraries to make common patterns safe. Why was the logging framework happy to log the PIN, well, because the type system didn't know the PIN is sensitive. Why was the PIN even sent in the clear at all, well, because libraries to do this securely aren't well known and the web doesn't help.