The Equinox security manager comes in handy when wanting to manage passwords or any other information that should be treated in a secure manner. In the aggregator I’m using it to store all credentials required to log onto the web site that serves the feed.
So if the feed does require that we log in we first obtain a node in the secure preferences, using the plug-in identifier as the identifier for the node.

URLConnection yc = feed.openConnection();
yc.setAllowUserInteraction(true);
if (!site.isAnonymousAccess()) {
 ISecurePreferences root = SecurePreferencesFactory.getDefault().node(AggregatorPlugin.SECURE_STORAGE_ROOT);
ISecurePreferences feedNode =
 root.node(site.getUUID().toString());
try {
 String credentials = feedNode.get(
   AggregatorPlugin.SECURE_STORAGE_USERNAME,EMPTY_STRING)
   + ":" + feedNode.get(AggregatorPlugin.SECURE_STORAGE_PASSWORD,EMPTY_STRING);
 String encoding =
   EncodingUtils.encodeBase64(credentials.getBytes());
 yc.setRequestProperty("Authorization", "Basic " + encoding);
} catch (StorageException e) {
 return new Status(IStatus.ERROR,
   AggregatorPlugin.PLUGIN_ID,
   "Could not obtain credentials", e);
 }
}

Next we obtain the node for feed itself. Since all feeds are identified by a unique identifier (could have used the URL though) we’re using that for the node identifier. Now it’s simply a matter of composing the credentials and encode these for the URL connection.
Since this code is executed inside the IStatus run(IProgressMonitor monitor) of a Job instance it makes good sense to handle the exception using an IStatus instance here.