These challenge response mechanisms still require a shared secret. This means the server still needs to know either your password or a hashed version of it. TLS covers the problems a challenge-response method is supposed to solve. That is, TLS prevents replay attacks because the shared secret is sent under encryption.

Really, the solution to exposing passwords to the endpoint is to do key-derivation client-side, with a server-provided salt.