Does hashing once on clientside and once on server-side increase security when dealing with an untrustworthy server? For example when dealing with open source projects where users can self-host their version of the service. My thought process behind this:
- When only hashing clientside it's essentially sending plain passwords but with the benefit of the server not knowing the actual password which could help against a malicious server owner brute-forcing these passwords on other services (e.g Netflix) to get access to his users' accounts.
- Hashing only serverside has the disadvantage stated above
- So why not combine both?
Is there something I am missing? Does this increase security in any way?