I was reading about Windows Authentication in IIS7
I know from experience that Windows Authentication technically works OK over the Internet using IIS - meaning user is challenged with 401 not authorized, and that most browsers (Chrome, FF, IE, Safari) prompt for windows domain\user and password, and that if authentication succeeds, and if authorized, the user gets the requested page.
But then I read this:
Windows authentication is not appropriate for use in an Internet environment, because that environment does not require or encrypt user credentials.
HTTPS can be used for encryption, but I am seeking clarification on the other part.
What does "does not require user credentials" mean?
And based on that, the real question: besides using HTTPS for encryption, how do I implement Windows Authentication in a secure manner for use in an Internet environment?
The Microsoft claim seems unfounded. I get that if using NTLM instead of Kerberos you lose the direct connection to a trusted third party identity provider, but that doesn't explain to me why credentials would not be required if implemented properly. Seeking that method. Thanks.