>You're assuming that the attacker controls the connection with the user. I am making no such assumptions. >Such an attacker is free to serve a login page tha

>You're assuming that the attacker controls the connection with the user. I am making no such assumptions. >Such an attacker is free to serve a login page that sends the unhashed password, and read that. Depending on the nature of the server exploit, and depending on if the client code is even delivered via the same server handling requests in the first place. Both are quite large assumption to make.