zlacker

The assumption that only one party knows the password is not always (maybe even usually) incorrect. Plenty of sites store the password in plain text or hash on the server side. Meaning it's very possible for both parties to know it.

>>hahn-k+(OP)
Ignore this, I misread what the author above wrote.