> The idea that you would have a password but not send it to the identity provider makes no sense It's possible to prove to a remote system that one knows thei

> The idea that you would have a password but not send it to the identity provider makes no sense It's possible to prove to a remote system that one knows their own password without sending the password (or an equivalent, like NTLM hashes). Secure Remote Password protocol (SRP)[1] is one specific implementation. [1] https://en.wikipedia.org/wiki/Secure_Remote_Password_protocol https://en.wikipedia.org/wiki/Secure_Remote_Password_protoco...