Fully agreed on the server compromise risk. Fortunately this attack vector would compromise only users who log in after the attack. Users who don't are still sa

Fully agreed on the server compromise risk. Fortunately this attack vector would compromise only users who log in after the attack. Users who don't are still safe. Improving this situation could involve keeping a browser extension that takes care of the hashing algorithm and makes sure the real hash is sent. As long as the extension is not updated, the hashing would be safer.