3

What are the downsides? None, really, aside from significantly increased complexity1, which is rarely a good thing, as well as high migration costs for literally every website with a password field, which is also not a good thing. But let's consider the implications anyway, to see if they outweigh the costs. There are two ways you could handle this hash: ...


1

Generally browser's local storage and cookies are considered safe, since if user's machine is compromised we can't do anything. However you can (somewhat) increase the security of data at rest with a layer of encryption. To store the keys securely on user's machine you can request a password from user, which (after passing it through KDF, for example PBKDF2)...


1

This is a reasonable idea, but there are some problems with coordinating massive centralized efforts. KOLANICH already suggested SRP, very nifty and even more secure protocol for remote passwords. The main problem is that very few people actually care about security to force whole IT industry to change what's already working. Meanwhile privacy freaks can ...


Only top voted, non community-wiki answers of a minimum length are eligible