Windows Authentication will use one of the Windows Authentication methods, be it LAN Manager, NTLM or NTLMv2, the option should specify. LAN Manager is deeply insecure and NTLM has known vulnerabilities, but NTLMv2 can be considered secure given a complex eight character password (the jump in time to crack between seven and eight characters is huge).
Basic will submit everything in the clear and should only be used in situations where the connection itself is encrypted.
Most applications will try the most secure method and work their way down the list, but not all applications do. Indeed, I believe one version of Internet Explorer tried Basic first.
|