Do web apps encrypt passwords during login when integrated security is enabled within IIS? <p>I have always enabled integrated security on my web apps inside IIS with the assumption that the passwords that are requested on the client end will always be transmitted securely (encrypted) to my authentication server (AD/LSA). Am I correct on my assumption? The reason I have always assumed this is 'coz I always think of them as being very similar to authenticating a windows client with an AD in which case the client &amp; server will either employ NTLM or Kerberos for authentication where the passwords are always encrypted.</p>