Technically speaking that's not a zero knowledge proof, because it requires what would be considered a trusted third party (the service being logged into). Ostensibly that service "knows" the password (or a functional substitute), and the prover is only proving password possession insofar as the third party service can be trusted.

In your Where's Waldo example, this would be like having a non-playing third participant whose trusted by both players. When one player wishes to prove they've found Waldo without ending the game for the other play, they'd demonstrate this in full transparency to the third party verifier, whose word would then be trusted by the second player.

How does she do that?!