[swiftcoder]

> No, the defining characteristic of a password is also how it is used: it is communicated in the clear to the verifier

This is only true if the verifier lives on your local terminal - otherwise we use an encrypted channel to transmit to the verifier, or do the exactly same type of timed-salted-hash scheme used here to transmit without revealing the password.

[ulrikrasmussen]

The thing is that you are sometimes tricked into giving the password to someone who is posing as the verifier.