I wish we could just avoid all of this by using methods like SRP[1] where the site wouldn't even need to know the plain-text password in the first place. Why am

I wish we could just avoid all of this by using methods like SRP[1] where the site wouldn't even need to know the plain-text password in the first place. Why am I giving a "secret" to someone else? [1] https://en.wikipedia.org/wiki/Secure_Remote_Password_protocol https://en.wikipedia.org/wiki/Secure_Remote_Password_protoco...