Both these protocols normally use the SSH (Secure Shell) protocol to communicate with the CVS server, meaning that your passwords and data are safe from eavesdroppers (although :ext: can be configured to use other protocols as well).
The difference is that :ssh: uses an SSH client built into CVSNT, while :ext: relies on an external SSH client.
If you use CVS from the command line, :ssh: has the advantage that you do not need any other software. Since TortoiseCVS already comes with its own SSH client, there is nothing gained from preferring :ssh:. Additionally, at least some versions of CVSNT have problems communicating with non-CVSNT servers, such as those used on the majority of UNIX servers.
Another important point is that it is not possible to configure :ssh: to use another port etc. in the Preferences dialog of TortoiseCVS. That dialog applies only to :ext:. Therefore, we recommend that you always use :ext: instead of :ssh:.
