Gateway authentication: client authentication before connecting to server? Does authentication with SPS happen before server authentication?

If Telnet does not provide encryption features for credentials, why is it used in remote sessions? How can you fix this?