On countermeasures for replay attacks. Does this one require plaint text password storage?
Yes, that is a problem.  There are protocols like SRP that both eliminate the need for Bob to store the password in plaintext and prevent replay attacks.