Why Do We Still Pass Passwords Over a Network — Meet PAKE?

Why do we still pass passwords over a network?

Increasingly we use ZKP (Zero-Knowledge Proofs) to prove that the Bob still has knowledge of his password. Another method is PAKE (password-authenticated key exchange) and which supports the hiding of a shared password within network communications. With this we can have a relatively weak shared password on either side, and then communicate to determine a strong shared key:

With SPAKE2, Bob and Alice can derive a strong secret key based on a password that they both know. Eve, who is listening, will not be able to generate the same secret, even though she listens to their communications. If she tries to spoof Bob or Alice, she will only get one change to guess the password before she is locked-out. Thus, Bob and Alice can use a weak password, as Eve only gets one chance to guess. There is also no offline analysis, as the hand-shake must occur on-line. Along with this, there are no derived keys from previous sessions [IETF spec]: