>But the true password still has to be transmitted. The first time, and every time.

The password never has to be transferred. In fact never having the password should be the goal. Not even a first time. Don't let the password leave their device. You transmit the hash.