The assumption that only one party knows the password is not always (maybe even usually) incorrect. Plenty of sites store the password in plain text or hash on

The assumption that only one party knows the password is not always (maybe even usually) incorrect. Plenty of sites store the password in plain text or hash on the server side. Meaning it's very possible for both parties to know it.