I'm writing a small webapp and I don't want to transmit login passwords as cleartext. As I don't have SSL available I've written a one-time challenge system which sends a random string with the login form which is then used to hash the password using HMAC-SHA256 on the client-side. I use the random challenge string as the message and the user's password as the secret key for HMAC.
I know that self-made solutions are generally a bad idea, so I wanted to ask if I'm making a mistake here.
Edit: There seems to be a misunderstanding, I'm not asking about password storage or challenge/repsonse systems, but about HMAC and password transmission. To clarify a little: My first version was
HMAC(msg=password, key=challenge), because I thought, well, the message I want to transmit to the server is the user's password. But later I noticed that the challenge string is not exactly a secret key, so I switched it, but that got me thinking if I maybe do something entirely wrong and I thought I better ask about it.