> The usual approach for handling a password is: take the password as a string, as the user typed it. Ah. That usual approach, where any rogue employee or any

> The usual approach for handling a password is: take the password as a string, as the user typed it. Ah. That usual approach, where any rogue employee or anyone really snooping on either side of the connection before/after the TLS gets to see the plaintext password. Makes me wonder: is salted challenge response authentication (RFC5802 and 7804) getting any traction? Couchbase is (was?) using that. Is there a list of websites that went past what's basically the nineties' "plaintext password over SSL"?