To those unfamiliar, it's probably fair but only up to the point where you expect the site to be serving up the same code every time. It's a bit like JavaScript

To those unfamiliar, it's probably fair but only up to the point where you expect the site to be serving up the same code every time. It's a bit like JavaScript crypto; makes you feel good but has little bearing on anything in the real world. The server sends the client a hash of a secret, the client sends a locally generated nonce back, and the server hashes the two and determines the outcome. The idea being that the server can't change the result because the secret has already been verified as the same as before they rolled by the client via the previously exposed hash. Still relies on the code being served to not be changed on every load, which is a false assumption to make.