I was reading about Passwords and came across methods used for authenticating client to a server. Since sending password in Plain text to the server isn't the best method for authentication of a user, certain methods were described which provide resistance to replay attacks, MITM etc.
Some methods described were:-
1) Random Challenge method, where server providing a random string to client, client encrypting it with its key/password (symmetric) and sending the result back to the server. Server doing the similar process (or the reverse) to determine the authenticity of the user.
2) Relying on SSL/TLS for the encyption
3) Certificate based Authentication
My question is - Which of the above method is in current practice? Like when we try to login to our Google, Facebook or Stackexchange account which authentication method is used?