This question already has an answer here:
I've been reading about hashing and encryption so I can make more informed decisions.
I already know the benefits of ssl and password hashing serverside as best practises. However I was wondering, as a platform holder, whether it would be better for my users for them never to have sent my server their passwords in their original form. I.e type password, hash on client, send over ssl, hash with salt to database... rehash on client and server and compare on login.
Would this enable a service to claim to never having had a users password at all in a way?
UPDATE This was marked as duplicate, but my question is concernd with protecting the password from the service itself, not any man in the middle attack. With SSL or plain text to the server, the server gets the password. Is there a way of sending a password / or loggin without the server knowing the password. hope that makes sense :)