Comment by severino

> why bother with basic auth at all, especially when there is no TLS?

Maybe to have some "basic" auth for an embedded device web interface or something like that? I suppose it's better than nothing. I've devices which prompt for username and password with no TLS either.