title: IIS 7 secure windows authentication over the internet
body: <p>I would like to deploy my great new ASP.Net app to my internet facing web server. I would like to use windows authenticaion over the internet, so that I.E. automatically prompts for windows login credentials. I want to make sure it is adequately secure.</p>
  
  <p>Some parameters around this are:</p>
  
  <ul>
  <li>I do not wish to implement SSL at this stage.</li>
  <li>We only have one server to authenticate to.
  I've read a lot about man in the middle attacks redirecting authentication information to a third party server, but in my case there is only one server - the one they are logging on to.</li>
  <li>I've been reading about IIS Windows Authentication Extended Protection, but I'm still uncertain of it's benefits</li>
  </ul>
  
  <p>So basically if I enable IIS Windows Authentication Extended Protection, and I can be certain no one gets phished, can I be pretty certain that this is going to be secure?</p>
  
  <p>Our server regularly suffers attacks - I think a few mistakes in the early days have got it on to an 'easy target' list.</p>