Basic autnentication is only weakly secure
Created originally on Bitbucket by DankMaymays (Bubba)
Basic authentication over SSL doesn't provide good security. The large attack window caused by sending the password with every request is just one of numerous issues ([1], [2], and many others).
With TortoiseHg, it seems like the only other option is SSH. This doesn't fit many situations (I'm talking about self-hosted, not Bitbucket), and has disadvantages, such as lack of browseability. Providing this side-by-side with basic auth and encouraging the devs to use SSH is a sort-of-ok-but-not-great compromise.
There really ought to be support for better web-based autnentication, such as TLS client-side certificates.
References: [1] http://security.stackexchange.com/questions/988/is-basic-auth-secure-if-done-over-https [2] http://adrianotto.com/2013/02/why-http-basic-auth-is-bad/