title: Is WCF Username Authentication without Transport Security a security risk?
body: <p>I am trying to use username message security in WCF. I am trying to find out if using transport credential type of None/Anonymous will pose a definite security risk. </p>
  
  <p>My concern is with the initial exchange where binary data is tunneled through using the WS-trust specification (TLS negotiation). Will this attempt to authenticate my username and password be susceptible to network sniffers, before the shared security context is established?</p>
  
  <p>Any thoughts welcome.</p>
  
  <p>Thanks.</p>
  
  <pre><code>&lt;security mode="Message"&gt;
     &lt;transport clientCredentialType="None" /&gt;
     &lt;message clientCredentialType="UserName" negotiateServiceCredential="true" algorithmSuite="Default" establishSecurityContext="true" /&gt;
  &lt;/security&gt;
  </code></pre>