At work, we are moving a CRM to a hosted solution. I haven't been much involved in the selection process, but have asked some questions on password hashing that as it turns out we probably should have ...
Most programs do not send passwords between a client and server without hashing them yes? If you have a man-in-the-middle who does not know the algorithm for hashing this provides some security yes?