hashing

The real issue with getting your plain text password in an email is that it means the site is not hashing passwords at all.

If such a trojan is not specifically configured to grab Steam data, hashing/encrypting client-side will provide some protection.

The idea is to use constant time hashing functions, and then compare the hashes instead of comparing the strings themselves.

So, the argument is because the hash is displayed it can be reversed by subsequently hashing every known combination of characters with every known mail provider?

Robin Hood hashing) which means you need only 4GB memory.

My understanding was that hashing a hash was stupid because you've effectively limited your attacker's search space.

If they can modify resources you're loading but hashing, surely they can modify the resource delivering those.

This is 32 million times slower, which is a significant difference regardless of the speed of the hashing algorithm.

Even in those programs that do use it for hashing or encryption or something you'll find the vast, vast bulk of arithmetic is not.

Yes, and adaptive hashing makes those memorable passwords significantly more safe.

I'm suggesting something based on quadratic residues moduo a Blum integer instead of repeated hashing.

Little bit concerned on the computational cost of hashing function.

I wonder why I have never read about somebody handling logins this "double-hashing" way?

Think also of it this way: poor user password selection (and here we mean "ugh&8eat" is a weak password) sabotages the complexity of the attack, and adaptive hashing (like SCrypt) fixes that problem algorithmically.