[baybal2]

I'm surprised that's not being raised before. Tons of passwords in the web are still 100% plaintext on the other end of TLS connection.

And then people getting surprised from where do those ginormous plaintext password leaks come from.

All kinds of popular online forum engines were being hacked for password captures since times immemorial. PHPBB still uses server side hashing for example.

Now, for people concerned, take a look who was the party who sank crypto forms at W3C.