That plaintext of the shared secret doesn't have to be the password, it can be some other authorisation token which acts as a first level of auth before a passw

That plaintext of the shared secret doesn't have to be the password, it can be some other authorisation token which acts as a first level of auth before a password hash scheme is used. As I said, there is _almost_ never a good reason for storing the passwords digested or encrypted.