Is hashing passwords on the frontend a good approach?

This article uses a riddle about password hashing to reveal the limitations of front-end hashing in security mechanisms. It points out that if data is only hashed on the front end before transmission, the server effectively degrades to plain-text comparison. This allows operations personnel to use the hash value directly to call the API and log in, thereby negating the purpose of security protections. The author reviews the historical practice of early Tencent QQ, which used two-pass hashing to prevent man-in-the-middle attacks, and explains why this scheme failed due to vulnerability to replay attacks. True defense against man-in-the-middle attacks relies on TLS encryption. Drawing from personal experience, the author describes how, during the era of rampant ARP spoofing, plaintext protocols like email were easily attacked, while modern TLS handshake mechanisms have significantly improved communication security. Finally, the article emphasizes that technical measures are not a panacea. Social engineering attacks, such as browser plugin abuse and phishing sites, remain a significant threat. Enhancing users' security awareness and basic judgment skills is the fundamental solution.