On: PHP bug: Password_verify() always return true with...

[bawolff]

I don't understand the scenario. You're saying this is bad if you hash on client side and compare to a plaintext password stored on the server?

I mean, i suppose, but such a setup is so broken does it matter?

[jefftk → bawolff]

I agree that this is broken, and loses much of the benefit of hashing. But this is the php ecosystem; I'd be surprised if no one was doing that!