I'm making recommendations to improve our user authentication (login). Our approach thus far is to ensure we (and libraries we use) are following all of the the OWASP guidelines.
I have also been trying to study what Google, Microsoft and Yahoo do. As far as I can tell, they do not directly transmit passwords to the backend (just put a breakpoint for XHR items and see for yourself).
My question is therefore straightforward. What are they doing to passwords before they are sent the backend (possibly the same or different)?