I agree with jedberg’s assessment that the password scheme described above, while preventing the direct transmission of a plaintext password, is still vulnerabl

I agree with jedberg’s assessment that the password scheme described above, while preventing the direct transmission of a plaintext password, is still vulnerable to an offline dictionary attack in the event the server database is compromised. One solution may be to look into https://en.wikipedia.org/wiki/Zero-knowledge_password_proof https://en.wikipedia.org/wiki/Zero-knowledge_password_proof