Discussion between Steffen Ullrich and Delfin

Imported from a comment discussion on https://security.stackexchange.com/questions/276176/alternatives-for-password-where-at-least-one-secret-is-not-know-by-the-server-w/276177#276177