I understand why the SSL client certificates are not widely used (need to install them, problems with shared machines etc.). On the other hand when I log into the server the password is send to it and it is in server's memory. Also if the server certificate leaked and there was DNS spoofing there is little protection against getting the password by MITM. While attacks of such type are rare they still happens (see diginotar).
I came out with very simple scheme - because it is not widely used I assume that something is wrong with it:
On password set up:
- Random salt is generated (by client, server or both)
- The client gets salt and password and seeds the previously agreed cryptographically secure PRNG
- The public key and salt is stored on server
- Salt is send to client
- Client regenerates the private key
- The authentication relays on challenge/response between server
Is there any disadvantage of such scheme (except the additional computational/transfer overhead)?