It looks like the actual best answer is to use ssl - apparently most apps transmit their password in the clear, and just rely on ssl to keep it from being observed. I'll amend my post.