I've read the Matasano whitepaper on why you can't count on Javascript for security, as I imagine you have, and it makes sense. Use https.

That being said, look at something like blockchain.info.

It adds javascript security on top of https, and for (what seems like) excellent reasons.

I was just musing hypothetically, but can you elaborate on why this is bad? Surely sending an encoded password is better than a non-encoded one, and in a worst case only as bad as sending a cleartext password (i.e. what happens now).