>> we'd probably be better off using some sort of PAKE protocol
Yes, that's my whole point. This problem has been solved, there are tons of libraries, it's not that hard. Why have a weak link like this?
If everything is secured correctly, this is not a vulnerability, but how often are things 100% secured properly? TLS is fine, but many people use a self-signed certificate, which means a MITM attack is often possible. It's bad enough to have someone snoop on your connection, but to have your password compromised... And if your client is not Windows, it often has to use database authentication.
This just stinks. It's especially surprising in an enterprise-class system like SQL Server.
Isn't that also exactly as insecure as submitting an HTML form with <input type="password"> is? And I can't think of any enterprise apps that don't use either HTTP basic auth or that over TLS. Which ones are you thinking of?
