It's pretty much like forms based auth which is used by virtually every user facing web site with a login, wherein the data you send over is plaintext. And as

It's pretty much like forms based auth which is used by virtually every user facing web site with a login, wherein the data you send over is plaintext. And as we know, that needs to be done over TLS.