Password-Digest instead of "cleartext" password in RST

[Axel Nennker]

Hi,

why are we using a simple Username and Password authentication where
those are send as cleartext to somewhere while
http://www.oasis-open.org/committees/download.php/16782/wss-v1.1-spec-os-UsernameTokenProfile.pdf
defines an easy alternative?

Yes, the selector makes extra sure that the certificate of the STS is
not expired, not revoked and the chain is checked that it is issued by
a trusted source... Well, maybe.

I think that it does not hurt (even in javascript) to create a nonce,
a creation date, to concat those with the password and to hash the
result. And then use SSL transport security on top.

too paranoid?

cheers
Axel