lennaert Well you bumped a thread where I made comments about three years ago, and my stance has changed: as long as you have a decent SSL implementation, you should be OK - but you should still send password hashes and not actual passwords, so they're not even plaintext on the receiving endpoint. Anyways I don't consider myself a security expert so don't ask me.
Ashley ASHLEY SAID