The difference is that you're never entrusting the authenticating party with any secret. Even if their entire full-cleartext database leaks, an attacker could not even authenticate against that _same_ site.