The first step in the SRP protocol is to retrieve the cryptographic salt from the server, so you're essentially free to roam. This step has concerns of its own

The first step in the SRP protocol is to retrieve the cryptographic salt from the server, so you're essentially free to roam. This step has concerns of its own though... for one thing the request itself reveals that the username/id is valid, and if you cache the userid / salt pair on the client machine it's vulnerable to snooping by other people with physical access. There are some fairly straightforward tweaks that can be made to the protocol to work around these issues though, since the salt isn't sensitive. In fact, I'm pretty confident storing the salt server side can be eliminated.