> Really, the solution to exposing passwords to the endpoint is to do key-derivation client-side, with a server-provided salt. That sounds a lot like Secure Re

> Really, the solution to exposing passwords to the endpoint is to do key-derivation client-side, with a server-provided salt. That sounds a lot like Secure Remote Password protocol: https://en.wikipedia.org/wiki/Secure_Remote_Password_protocol https://en.wikipedia.org/wiki/Secure_Remote_Password_protoco...