Comment on Microsoft mishandling example.comparentComments−lazide7moNot necessarily, the server can say it only supports basic auth and….−gruez7moI don't think there's any evidence that windows sends cleartext passwords. The whole reason why NTLM is a thing is to avoid sending cleartext passwords.−lazide7moOutlook appears to be−p_ing7moThe 'https://' disagrees with your 'sending clear text passwords' statement.−lazide7moIt’s clear text to the receiving server, which is what we’re talking about, not one way hashed.
Comments
Not necessarily, the server can say it only supports basic auth and….
I don't think there's any evidence that windows sends cleartext passwords. The whole reason why NTLM is a thing is to avoid sending cleartext passwords.
Outlook appears to be
The 'https://' disagrees with your 'sending clear text passwords' statement.
It’s clear text to the receiving server, which is what we’re talking about, not one way hashed.