<i>&gt; with email and plaintext password</i><p>It&#x27;s totally reasonable to transmit a password in clear if it&#x27;s being transmitted inside of an SSL tunnel (which it is in this case).<p>Most if not all techniques that would allow for not transmitting the password in a server-decryptable fashion would require the password or a password equivalent to be stored in clear on the server.<p>In case of a breach, that would be devastating.