There seem to be quite a few issues raised here, so let's stay focused and not discuss persistent cookies and making SSL setup easier here (separate topics can be raised for this if necessary).
As far as security is concerned, there seem to be two issues here:
1) Aware IM links are not secure enough. Fair point.
2) Communication between the client and server is not secure.
Regarding 2). If you want this communication to be secure then you must use https and SSL - this is what it is for. So unless I am missing some important point here, let's not discuss 2) here, either.
Regarding 1). The "cloak" solution which involves Base64 with XOR shifting is fairly easy and can be included in 5.7. You will have a function that will encode all the information in the link:
http://locahost:8080/AwareIM/logonOp.aw?e=abdrrjafdee....
where everything after e= will be an encrypted representation of the proper link parameters like:
domain=Blah&userName=blah&password=blah&firstCommand=blah
To achieve the encryption you will use this function in your configuration when generating the link:
ENCODE_LINK ('domain=....')
Aware IM will automatically decrypt the encrypted link.
Later on we can increase strength of encoding to use 128-bit DES encryption with parameter e2=... and the function ENCODE_LINK2
Please provide your comments ASAP. 5.7 is nearly ready. If this is something that you can live with, it will be included in 5.7 straight away.
