It's out-of-spec as of [link|http://www.ietf.org/rfc/rfc2396.txt|1998]. However, like many legacy things, it endured. For MS to break it like they did is extremely inconsiderate. And, they broke it for the wrong reason. Not because user name/password is transmitted in clear text (it isn't, really - it's parsed by the browser and used in normal authentication protocol). Rather, because it's used to mask the real hostname in URL. Stoooopid.