[k3d3]

It mitigates passive MITM attacks, for one.

On the other hand, there's nothing that's made _worse_ by choosing to do it that way. Plenty of things that are the same, some things better, but nothing worse.

[Stefan-H]

Hardly - if you are not using HTTPS in the first place then sending the hash across the wire instead of the password are the least of your worries.