> it should be possible to implement browser-side encryption enough to securely transmit the password. That only helps against passive eavesdroppers. Without a

> it should be possible to implement browser-side encryption enough to securely transmit the password. That only helps against passive eavesdroppers. Without a way to authenticate the device, a man-in-the-middle can easily pretend to be the device and receive the password.