Yes, you are wrong.
> we basically have three options
Or sending the plaintext password over the wire using SSL?
You are aware that to use a hash the server needs the plain text password right? And not just them, every server needs this?
You are acting like getting the plaintext password is something strange. It's not.
You can send the password encrypted or not, it has nothing to do with the hash on the server.
> but that still wouldn't allow them to compute the 2x hash
As I have said already, they are not computing the 2x hash.
Yes, you are wrong.
> we basically have three options
Or sending the plaintext password over the wire using SSL?
You are aware that to use a hash the server needs the plain text password right? And not just them, every server needs this?
You are acting like getting the plaintext password is something strange. It's not.
You can send the password encrypted or not, it has nothing to do with the hash on the server.
> but that still wouldn't allow them to compute the 2x hash
As I have said already, they are not computing the 2x hash.