Hacker News Reader

So some sort of public-key cryptography?

I didn't realize that the HN login page didn't send a password on a login.

I'm not sure I understand you; CC numbers are not passwords. You can't salt and hash them on one end and then confirm on the other end; you need to send the whole number if you expect to process a charge against it.

You mean "not at all"? Just fire up a packet sniffer...

But you do send your actual password... The hashing occurs on the server. Also, this has nothing to do with credit cards. They are not passwords.

The HN login sends your password over the internet. It doesn't even use SSL. It is in the clear, readily visible to anyone able to run a packet sniffer on your traffic.