I think this actually does protect you from exposing your password to an attacker, but only at account creation time. If the attacker waits around for you to lo

I think this actually does protect you from exposing your password to an attacker, but only at account creation time. If the attacker waits around for you to log in conventionally at some later time, then it's over.