That’s how you do passwords. The alternative you are looking for is keys, and the entire internet decided those are toxic and no user must be able to handle them (except for the ones that give monopoly over authentication to Apple and Google, a lot of people like those).
Do the passwords come across in clear text over a compromised TLS connection due to bogus certificates?
That’s how you do passwords. The alternative you are looking for is keys, and the entire internet decided those are toxic and no user must be able to handle them (except for the ones that give monopoly over authentication to Apple and Google, a lot of people like those).