It requires credentials, but with a standard format/protocol it means extraction is easier for someone who might happen to acquire such credentials with nefarious intent.