I was reading this wiki section on the countermeasures against replay attacks and it basically suggests that:
If Bob wants to confirm Alice's identity he can send a one-time token (I think it should be called a 'salt') to Alice which she appends to her password and hashes it before sending it back to Bob, who in turn also does the same operation and compares the results.
But if Bob must perform the same operation i.e. append that token to Alice's password and hash it, then he must also have the original password stored, right? Isn't this a security risk?
So the question is: Does Bob have to have a plain text version of Alice's password and if not, how does he avoid this requirement?