Assuming I currently use a safe way to salt-challenge-response-authentication-method, passwords are stored secured and all.
I now question myself - how do users set the password? Meaning, they enter password as plain text in the textbox, and what happens next? should their client hash the password and send it to the server to be salted? isn't that prone to MITM+rainbow-table ? I was thinking about querying the server for the salt, and then the client hashes and salts the password and that's what will be stored in the DB along aside the salt.
What do you think?
Also, Is it ok\better to store the first part of the hash which is the combination of the username and password with salt? meaning that when they change username they'll need to reset their passwords aswell.