It would be just slightly more complicated to inject a script that POSTs back anything typed into a password field. Hashing passwords client-side would just pr

It would be just slightly more complicated to inject a script that POSTs back anything typed into a password field. Hashing passwords client-side would just provide a false sense of security. Surely if it's worth doing it, it would be worth the cost of an SSL certificate and the overhead of protecting (a minimum of) all pages and requests handling passwords?