There is something like Secure Remote Password (SRP)[1] where it is possible to verify a password without password being to transmitted to the server at all. T

There is something like Secure Remote Password (SRP)[1] where it is possible to verify a password without password being to transmitted to the server at all. The problem is, it is tricky to implement, a little bit old, and still vulnerable to bruteforce attack (Blizzard uses it, and IIRC their verifier database was leaked once, with g and N being published, so anyone could do dictionary attack on it. I believe Apple is also using it). [1]: https://en.wikipedia.org/wiki/Secure_Remote_Password_protocol https://en.wikipedia.org/wiki/Secure_Remote_Password_protoco...