Most websites are data sinks of anything that can be taken. No reason IMHO the login page should not always send a hash over ssl. (which is hashed again to test it)
Re:Safari tries to fill username
by jimktrains2 on Friday May 28, 2021 @07:52AM
(#27314251)
I'm not sure what you mean by hash, but i6 think you're trying to describe mutual authentication, where the service also authenticates itself to the user. Look up things like pake, srp, and tls client certificates for more information.
https://en.m.wikipedia.org/wiki/Mutual_authentication
https://en.m.wikipedia.org/wiki/Secure_Remote_Password_proto...
https://en.m.wikipedia.org/wiki/Password-authenticated_key_a...
I believe moat browsers will use the system keyring (which is usually encrypted based on your login password or a tpm) if present or use a master password to encrypt them at rest.