Clear text username password authentication in Wcf over https

Question

My question may be very silly but here it is.

I went through this question. jassuncao has suggested to use custom binding created Yaron Naveh. Now that it is not a very secure way of authentication, my question is, what if I use Yaron's custom binding and put my service behind https? Will it still be unsecured?

Answer 1

If you are using SSL, the transport will be secure. There would be no need for a custom binding.

From the page on Introducing WCF ClearUsernameBinding that you mentioned:

Sachin said... 
How does this work in IIS hosted environment with SSL certificate. Also in order to provide interoperability how will the clients using non woindows environment will be able to provide the user credentioals? 

February 18, 2009 9:06 PM  
 Yaron Naveh said... 
Hi Sachin

When SSL is used there is no need for clearUsernameBinding - you can use the out of the box WCF configurations.

As for interoperability, clearUsernameBinding adheres to the WSS username profile.