Within the Windows Security authentication mechanism active, there are cases the user-login popup comes up. Are this username and password sent encrypted or they are sent as plain-text as the auth-basic protocol does?
I wrote a more detailed question here:
http://forums.iis.net/t/1226390.aspx?Security+behind+Windows+Security+Integration
becasue this site was not working before.
If I well understood the following answer:
How secure is Integrated Windows Authentication for IIS SMTP?
The fact relies on the protocol that make the request but I doubt if the protocol set at the address bar (http | https) is taking into account when the header("WWW-Authentication") is request. Since that answer was for SMTP I am still with the doubt for HTTP.
Could anybody confirm how secure is it, please? Thanks in advance for your time.