A couple of security-related issues have been bugging me of late, and I was wondering if anyone has a good answer...

1. When you access a "password protected" directory via .htaccess, it asks you for your ID and password in a popup. Is this data transmitted in the clear, or is it encrypted in some manner (similar to SSL)? If it's in the clear, it doesn't seem like very useful (or strong) security.

2. Why is it that most forums seem to ask you for your password on an unprotected (non-SSL) page? I would consider an account password to be quite sensitive information, and would prefer to enter or change it on an SSL-protected page, even if that requires an extra step. The same goes for store customer account and similar sign-ons. Whenever I have to use unencrypted WiFi, that's a big concern, since anyone can listen in on the traffic.