I am missing something about the usefulness of has

Question

So, hashes are useful because they change password/login name/salt value combinations to a code that cannot be reversed. The client sends this hash to the server. The server compares the hash to a list of stored hashes to see if the client's user may be granted access. But how do I prevent a malicious user from intercepting the hashed password and writing his own client that sends this hash to the server?

Answer 1

In many systems, the value which is hashed is not static, but uses a nonce each time an action requiring authentication is requested. The server sends a unique value to the client, which is combined with the secret and hashed. This can prevent replay man-in-the-middle attacks.