Comment by sebringj

Personally as a developer I'm not thinking Facebook is bad but rather that in general we are bad and we pass over plain text passwords to endpoints (through SSL) and just trust the data will not be abused (logging) but would be cool to have client-side encryption prior to sending to any 3rd party so figuring out a way to do that cleanly on different devices where a password, although the same everywhere possibly but is always encrypted uniquely for a particular company prior to going over the wire so even if compromised internally would only be for that particular service. This is probably just a legacy problem in the end where a new approach would simply make this problem obsolete like a yubikey or built in protocol at some point.