No, it does hurt. It also means that you're making up crypto protocols, which is not something you do for fun.

Use SRP or similar if you need private password transfers (which again is still pointless if the client isn't trusted).