I am developing an ASP.Net MVC 3 intranet site that will use Integrated Windows Authentication exclusively. What are the vulnerabilities of the challenge/response authentication traffic being sent in plain text? Will someone sniffing the network traffic be able to hijack an authenticated session?
NTLM is probably one of the better options you've got in terms of authenticating in the clear, but you still have plenty of vulnerability if you aren't encrypting the transport layer, even in a somewhat trusted environment. Basically, if the data matters spend the extra $25 and get yourself a legit certificate.