[hueving]

>it remains the problem of distributing that password to the client in a secure way.

That's no different. It uses the same channel the user would send the password to it.

[gluczywo]

With the difference that when user types the password it is not displayed on the screen. Server-side generated password must be somehow presented to the user.