changing the default port is pretty simple...

edit the http-tt.tcl file...
look for: socket -server session 80

make the 80 any port u want.

adding a user/pass would take a little more work.. i havent done it.. maybe somebody in here has? personally, i wouldnt be putting the tivo machine directly on the net anyhow.. i can think of a few clients connecting to the web port and hanging your tivo pretty quickly...

Personally I like to keep my TiVo as a PVR and not start loading it up with additional functions like security. I suggest having a firewall box in front of your TiVo. With IPChains on Linux you can control which services are accessible from which domains/IP addresses. While I have not done it, I think you could route any packets coming in on a port to another address behind the firewall, i.e. the TiVo.

My Linux box only allows access to port 80 from the world to go to a home webpage and access on port 22 (secure shell) from my work IP address. I can log into that box from work using SecureCRT, an SSH client. I can access my TiVo using Lynx, which is a character based browser, so I do have full control of the unit. It's very workable. Unfortunately I can only get Telnet working from one of my Windows PCs and not from that Linux box (the connection is always dropped -- anyone have any ideas?). If I was able to do that, I could Telnet from that Linux box into the TiVo and run ExtractStream etc. from work.

I do not respond to pings or trace routes to keep a low profile. While nothing is completely secure, I think my setup is hard to find and then hard to break into.