How secure is Integrated Windows Authentication by password?

Question

If client is accessing file on windows server through http (not https) and authenticates using Integrated Windows Authentication in browser, how securely is the password sent?

Is it sent in plaintext or not?

Answer 1

Using Integrated Security the password is not sent across the network at all making it a far better choice than Basic or Digest. There are some caveats that you need to know about, such as browser support, external authentication, delegation, etc.

Have a look at this article for a description of what happens with Integrated Security and things to keep in mind. Look at Integrated Security in the Authentication Methods section.

From the article:

Integrated Windows authentication (using either NTLM challenge/response or Kerberos) involves authenticating a user with a Windows NT Domain or Active Directory account. Unlike Basic and Digest authentication, the encrypted password is not sent across the network, which makes this method very secure. If Active Directory Services is installed on the server and the browser is compatible with the Kerberos V5 authentication protocol, both the Kerberos V5 protocol and the challenge/response protocol are used; otherwise only the challenge/response protocol is used. It is best suited for an intranet environment, where both user and Web server computers are in the same domain and where administrators can ensure that every computer is running Microsoft Internet Explorer version 3.01 or later.