Comment by undersuit

5 days ago

Don't store the hash the client sent you. Hash the hash on the server side.

Which makes the hash the password and the hash of the hash the hash. You achieved nothing. If you truely don’t want to send the password, there are of course ways. But it’s a heck of a lot more complicated than this and no one is doing any of it because… Passkeys is what you end up with.