how long have you been a web developer? Because I’ve been doing it for six years and almost every web app I’ve ever seen uses http with TLS to send the plaintext password to the backend, where it’s popped into a request var at the controller level, then passed as an instance var to the service level, salted, hashed and stored. This includes apps that have to submit themselves for HIPAA compliance because they deal with PHI.
I was under the impression that ludonarrative dissonance was when you purposely try to subvert the way the game “wants” to be played, rather than you trying to do what the game wants and the game failing to interpret your actions in a realistic or satisfying way. Like the people who try to be law-abiding pacifists in GTA V or people using armor stands to turn Minecraft into multiplayer chess.
I think that when they define “thief” as someone who will watch a TV show on Dailymotion when there’s no other way to get it, they’re going to be surprised how many people (especially schoolkids) are willing to say “Yes, I’m a thief.”