Although this method is still supported, it is DEPRECATED and should not be used. Client authors SHOULD use another authentication method if it is available to them.
The default authentication method is known as “clear”, which refers to the fact that passwords are being sent as plain-text (“in the clear”). Though clients have the ability to encrypt passwords in a one way hash function (MD5) and send them to the server (as hpassword), they are still vulnerable to replay attacks if the hashed password becomes known.
“Clear” authentication occurs when a username and either password or hpassword is passed to any client server protocol method.