The main in the middle could just decode any secret being sent. The only way I'd want to participate in a system like this is via a smartcard or a challenge bas

The main in the middle could just decode any secret being sent. The only way I'd want to participate in a system like this is via a smartcard or a challenge based system over TLS