What's the big deal with sending passwords in the clear? Your network security is not an application's problem. I understand the big concern with the Chinese fi

What's the big deal with sending passwords in the clear? Your network security is not an application's problem. I understand the big concern with the Chinese firewall, but really, obfuscating credentials to non-essential services is just not the biggest problem with it. If an attacker is already on your network, i.e. sniffing your traffic, you have far bigger issues than passwords in the clear. They don't need your password. They can already read the data just fine without logging in. Everyone is screaming HTTPS, but to be honest, that does not make you any safer these days. Check out SSLStrip and null prefix attacks on SSL certificates. Now think about what would happen if the government did that. Now then, is SSL still a solution to this problem? No.