Reed wrote:

...

Unfortunately, nothing beyond Basic Auth. seems to be

Well, Digest Authentication has now been finalized and is implemented (I believe) in IE5, though Netscape 5 won't have it.

...

standard, except full blown SSL, encrypting thre entire traffic stream (and it does slow things down). I suppose a Java applet would work, or perhaps even some really clever javascript? Eventually, this turns into a Diffie-Hellman key exchange sort of thing, doesn't it?

This is precisely the kind of thing Chris Petrilli was looking at doing. He's going to be taking over security in Zope, so I expect sometime in the next 3 months we'll make some kind of progress here. --Paul