Blizzard uses a challenge-response system called SRP for Battle.net. That's fairly mainstream.

You have to enter your password into all your devices anyway, so why not use challenge and response?