Comment by crote
20 days ago
Not true. There are lots of authentication schemes where the plaintext password is never communicated. This becomes rather crucial when the client doesn't know for sure yet what the identity of the other side is. See for example wifi encryption.
Cloning the knowledge in someone's brain is fairly easy. You just need a wrench.
Yes, but that is not how passwords work since the protocol for proving knowledge is that you enter it into the HTML form served by the party claiming to be the verifier.
If we are talking rubber-hose cryptography then a physical hardware token is just an insecure as a brain. Most people are not hacked via wrenches.
In other words: it's how passwords work on websites. Because it's usually good enough, as the only thing you are protecting is access to the server on the other side, and the pipe to that is already encrypted with TLS.
But this isn't a hard requirement. See Protonmail as a counterexample. And again, wifi authentication. I reckon debit card PINs as well.