100% agree. It's like when you call into phone support and the person on the other end obviously can see your plaintext password. I'm working with IP security

100% agree. It's like when you call into phone support and the person on the other end obviously can see your plaintext password. I'm working with IP security cameras, and the ONVIF standards [1] actually mandate Digest. I own cameras that only support HTTP Digest Authentication for RTSP. I'd tell the ONVIF folks this is dumb, but I don't want to pay $10,000/year for that privilege. [2] The only saving grace is that they aren't "real user" passwords, and you can isolate the cameras to a network segment where only the NVR can talk to them and vice versa. (And the NVR needs to keep the plaintext password anyway.) [1] https://www.onvif.org/profiles/specifications/ https://www.onvif.org/profiles/specifications/ [2] https://www.onvif.org/join-us/membership-levels/ https://www.onvif.org/join-us/membership-levels/