On: Using HTTP Basic Auth in 2022

[gsich]

Because pass the hash only works for the current server. People reuse passwords, so without brute-forcing you are out of luck.