Hacker News Reader

That would destroy security, since a compromised server could now get your password by serving malicious JavaScript...

Can't a compromised server already get your password by serving malicious JavaScript?

A malicious server doesn't need malicious javascript to do it, it already receives the password in the plain, but that is what is trying to be mitigated in these efforts.

I was thinking a malicious 3rd party JS (say a CDN copy of jQuery or something).

You might find interest in https://hacks.mozilla.org/2015/09/subresource-integrity-in-f...

So you agree that a js lib would be an improvement over the status quo?

Using a JS lib would not mitigate any risk here unless the compromising of the server that hosts the JS is separate from the compromsing of your web server.

It mitigates passive MITM attacks, for one.

On the other hand, there's nothing that's made _worse_ by choosing to do it that way. Plenty of things that are the same, some things better, but nothing worse.

Hardly - if you are not using HTTPS in the first place then sending the hash across the wire instead of the password are the least of your worries.

Reply on news.ycombinator.com