Hm, I guess I always assumed we would end up with SCrypt or something similar running on the client side with a nonce etc so the server never even sees the plaintext password.<p>Even if that means a new protocol that uses SSL to send the javascript, etc., and we're 15 years away.<p>Do you think designing a system where the server never sees (or has the opportunity to store) the plaintext password is the way of the future?<p>(Edit: more emphasis on future, not short term, ambitions.)