[KoRn]

Outlook Web Access is very insecure.

It only uses basic HTML Authentication, which is just lame. Usernames and passwords are sent in clear text, easily readable by a packet sniffer on the network. They need to implement encryption to correct this, which should be fairly easy to do.

[Doohickey]

Now that's just silly. OWA uses SSL. Passwords are sent encrypted in the secure session. DoD's beef with OWA is that it doesn't support two-factor authentication. By Executive Order, all web-based DoD systems have to support CAC cards.