and all this using javascript . instead of a different password , the client can stretch the password , derive two keys , one is the authentication key sent over to the server it can be SRP , and the other is used to unlock the private key on the client . it also has the benefit that the server never sees the password . however , you need to implement a proper password stretching and key derivation in browser javascript . <| sep |> For the most part we already do have those guys on our side . <| sep |> If you really want to hack my email and password for Tesla , then go for it . Tesla knows the IP of each request . They ' ll find ya . And then you ' ll have felonies to deal with . And that ' s just great for you . PS Two factor authentication ? LOL . What will they do , text you a code to your phone that isnt in your hands ?