yes so why in the world is my parent calling it a major design flaw? it's the norm! Sure, it's not perfect. Sure, a better option is to encrypt it yourself, and

yes so why in the world is my parent calling it a major design flaw? it's the norm! Sure, it's not perfect. Sure, a better option is to encrypt it yourself, and send it to the server. but as discussed endlessly in the comments here, it can NOT be done on web-mail currently (not securely atleast). So the common authentication mechanism is that you tell the server your password. Well you have to tell it to SOMEONE to show that you know it. So how is "transmitting your password" a flaw? The only other authentication mechanism i can think of is that your password is somehow used to generate a key-pair. The server encrpyts a session password with ur public key and sends to you. You decrypt with your private key and enter it. Hmm.... not a bad idea