[lazide]

Not necessarily, the server can say it only supports basic auth and….

[gruez]

I don't think there's any evidence that windows sends cleartext passwords. The whole reason why NTLM is a thing is to avoid sending cleartext passwords.

[lazide]

Outlook appears to be

[p_ing]

The 'https://' disagrees with your 'sending clear text passwords' statement.

[lazide]

It’s clear text to the receiving server, which is what we’re talking about, not one way hashed.