Non-SSL CAX - clear text passwords?

When using Client Access for telnet, you initially get the little pop up
window asking for your user profile and password.  I believe that this is
the 'signon server' task that talks to port 443 (or was it 446?
whatever...).  I would assume (please correct me if I'm wrong) that this
transaction is somehow encrypted (or at least not clear text).  After
completing this task, you get the regular AS400 signon screen.

If you're not running SSL, am I correct in assuming that all the traffic
back and forth to the AS/400 is clear-text and therefore when I log on my
user profile and password will be plainly visible to any packet sniffing
scoundrel?

Thanks.

++++++++++++++++++++++++++++++++++++++++++++
Go... FASTER!  Without an upgrade!  With ARCTOOLS/400(tm)
http://www.arctools.com
info@arctools.com
DCSoftware, Inc.
Ph: (508) 435-8243
Fax: (508) 435-4498
++++++++++++++++++++++++++++++++++++++++++++