When sending identity to a remote server in cleartext, you must assume that you are giving away the data associated with it, it's just basic security principles

When sending identity to a remote server in cleartext, you must assume that you are giving away the data associated with it, it's just basic security principles, if the engineers behind this don't care enough to KYC using cryptographic ways which already exists, then you can be sure there is some sort of incompetency and/or malice :) If I browse an http website, then I know that someone could be using the data, if I put my passport somewhere, then I know someone could as well, apparently having thousand of leaks every year isn't enough of a proof to people :/