Well it's their choice to ask the user to send a plain-text password. There are alternatives to avoid this, on the same model of SSH key authentication where t

Well it's their choice to ask the user to send a plain-text password. There are alternatives to avoid this, on the same model of SSH key authentication where the secret stays on the client-side. Nothing prevents them from using a password to derive a private key using PBKDF2 in client-side and answer to a specific challenge.