Hacker News Reader

Most services don't hash the password before sending it to the service, so it's going to pass through the service at some point.

You are right. The second point remains valid though.

If the client can securely transmit the password to the system for verification, the system can securely transmit it to the user in the first place.