use credentials in the open rather than secured