3 ms·

Which is almost as bad. A service provider does not need to know your password, just a salted hash of it.