I wish TLS-SRP was more prominent or that some mutual auth protocol was common (http://arxiv.org/abs/0911.5230 http://arxiv.org/abs/0911.5230). Then you're nev

I wish TLS-SRP was more prominent or that some mutual auth protocol was common (http://arxiv.org/abs/0911.5230 http://arxiv.org/abs/0911.5230). Then you're never sending anything sensitive to the server. Sure, it still has the issue of the user choosing a good password, but persona doesn't really get around this, just makes the mail server deal with it.