Yeah, users aren't asked about anything, the browser just sends their passwords to whoever asks.

The SSPI part is good, it just uses kerberos. But the full set can be downgraded at any time by the server.