> Say one can send the exact cryptographic fingerprint and impersonate me. How is this anything better than me just sending password to authenticate?
If you're genuinely interested in this topic, you will, I think, really enjoy what I'm about to tell you.
You can setup a system where: 1- you never tell the server your plaintext password at any time, ever; 2- the server does not know your actual password and cannot determine it; 3- you can prove to the server that you know the password, and they have strong proof that you do know it; 4- nobody that eavesdrops on you can do likewise.
Cryptography is magic. And it mostly has to do with the authentication protocol being multi-step. IE: you don't just send your password or fingerprint, you send X and the server sends back Y, and you send Z, and so on and so on, but after a few steps, you have proven yourself. And since it's all being done on GHZ speed computers and gbps networks, it's fast enough for human use.
There are better algorithms than this one, evolutions on the idea, but the most common one discussed is Secure Remote Password Protocol: https://en.wikipedia.org/wiki/Secure_Remote_Password_protoco...
And honestly, I'm not even doing justice to how cool these protocols are. It's an incredible topic.