I'm trying to wrap my head around authentication/authorization process within web-app that encrypt data on the client-side and I'm getting very confused about it. Hopefully, you could clarify it to me.
Where should encryption of the password happen, on the client side or server side? If indeed on the client side, then please, by all means, explain to me why... because if the network layer is compromised, potential hacker will get the encrypted password as it is(encrypted, yes) and because on the server the only thing that is done is comparing the encrypted password(encrypted on the client) with the one that is stored in the DB, it's going to be actually less secured.
What am I getting wrong here, please?
