You can store a hash of the password in the DB as opposed to the password itself. The only time the actual plaintext password needs to be passed is at registra

You can store a hash of the password in the DB as opposed to the password itself. The only time the actual plaintext password needs to be passed is at registration time, and even then you could add another hash step to get rid of that. What you can't get rid of is having to transmit something that is equivalent to the password at registration time, but you can at login time. The nonce (and a transaction id) let you construct a system that isn't susceptible to replay attacks.