We've had zero knowledge password authentication protocols for 20 years. At this point, any pain and suffering from these leaks is blood on the hands of browser vendors and web standards bodies.