A question I came up with while reading in my information security class. Let's say website ABC which uses username and password combinations to authenticate users and has a user John. When John goes to ABC.com to log in to his account and types his password, is the hashed version of the password transmitted to ABC's servers to authenticate John? Wouldn't the hash then just be the password? If an organization was listening in to John and stores the hashed password then they would just have to replay the password at a later time to log in as John.
I thought about ABC using asymmetric keys where the public key is available to John but the private key is stored on ABC's servers. So, John could encrypt his hash with the public key and only ABC could decrypt it using their private key. But then, how does ABC store the private key securely on their server?