diff --git a/telnet/main.c b/telnet/main.c
index ce33785..b165f4a 100644
--- a/telnet/main.c
+++ b/telnet/main.c
@@ -105,10 +105,10 @@ usage()
 	fprintf(stderr, "Usage: %s %s%s%s%s\n",
 	    prompt,
 #ifdef	AUTHENTICATION
-	    "[-4] [-6] [-8] [-E] [-K] [-L] [-N] [-S tos] [-X atype] [-a] [-c] [-d]",
+	    "[-4] [-6] [-8] [-E] [-K] [-L] [-N] [-S tos] [-X atype] [-c] [-d]",
 	    "\n\t[-e char] [-k realm] [-l user] [-f/-F] [-n tracefile] ",
 #else
-	    "[-4] [-6] [-8] [-E] [-L] [-N] [-S tos] [-a] [-c] [-d] [-e char] [-l user]",
+	    "[-4] [-6] [-8] [-E] [-L] [-N] [-S tos] [-c] [-d] [-e char] [-l user]",
 	    "\n\t[-n tracefile] ",
 #endif
 #if defined(TN3270) && defined(unix)
@@ -126,7 +126,7 @@ usage()
 	    "[-P policy]"
 #endif
 #ifdef	ENCRYPTION
-	    "[-x] [host-name [port]]"
+	    "[-y] [host-name [port]]"
 #else	/* ENCRYPTION */
 	    "[host-name [port]]"
 #endif	/* ENCRYPTION */
@@ -167,7 +167,12 @@ main(argc, argv)
 	user = NULL;
 
 	rlogin = (strncmp(prompt, "rlog", 4) == 0) ? '~' : _POSIX_VDISABLE;
-	autologin = -1;
+	autologin = 1;
+
+#if defined(ENCRYPTION)
+	encrypt_auto(1);
+	decrypt_auto(1);
+#endif
 
 #if defined(IPSEC) && defined(IPSEC_POLICY_IPSEC)
 #define IPSECOPT	"P:"
@@ -175,7 +180,7 @@ main(argc, argv)
 #define IPSECOPT
 #endif
 	while ((ch = getopt(argc, argv,
-			    "468EKLNS:X:acde:fFk:l:n:rs:t:x" IPSECOPT)) != -1)
+			    "468EKLNS:X:acde:fFk:l:n:rs:t:xy" IPSECOPT)) != -1)
 #undef IPSECOPT
 	{
 		switch(ch) {
@@ -227,7 +232,7 @@ main(argc, argv)
 #endif
 			break;
 		case 'a':
-			autologin = 1;
+			/* It's the default now, so ignore */
 			break;
 		case 'c':
 			skiprc = 1;
@@ -283,9 +288,6 @@ main(argc, argv)
 #endif
 			break;
 		case 'l':
-			autologin = 1;
-			if(autologin == 0)
-				autologin = -1;
 			user = optarg;
 			break;
 		case 'n':
@@ -321,13 +323,12 @@ main(argc, argv)
 #endif
 			break;
 		case 'x':
+			/* This is the default now, so ignore it */
+			break;
+		case 'y':
 #ifdef	ENCRYPTION
-			encrypt_auto(1);
-			decrypt_auto(1);
-#else	/* ENCRYPTION */
-			fprintf(stderr,
-			    "%s: Warning: -x ignored, no ENCRYPT support.\n",
-								prompt);
+			encrypt_auto(0);
+			decrypt_auto(0);
 #endif	/* ENCRYPTION */
 			break;
 #if defined(IPSEC) && defined(IPSEC_POLICY_IPSEC)
@@ -347,19 +348,6 @@ main(argc, argv)
 		}
 	}
 
-	if (autologin == -1) {		/* esc@magic.fi; force  */
-#if defined(AUTHENTICATION)
-		autologin = 1;
-#endif
-#if defined(ENCRYPTION)
-		encrypt_auto(1);
-		decrypt_auto(1);
-#endif
-	}
-
-	if (autologin == -1)
-		autologin = (rlogin == _POSIX_VDISABLE) ? 0 : 1;
-
 	argc -= optind;
 	argv += optind;
 
diff --git a/telnet/telnet.1 b/telnet/telnet.1
index 1da212c..8ff070c 100644
--- a/telnet/telnet.1
+++ b/telnet/telnet.1
@@ -42,7 +42,7 @@
 protocol
 .Sh SYNOPSIS
 .Nm
-.Op Fl 8EFKLNacdfrx
+.Op Fl 8EFKLNcdfry
 .Op Fl S Ar tos
 .Op Fl X Ar authtype
 .Op Fl e Ar escapechar
@@ -108,8 +108,8 @@ Disables the
 .Ar atype
 type of authentication.
 .It Fl a
-Attempt automatic login.
-Currently, this sends the user name via the
+Attempt automatic login. This is now the default, so this option is
+ignored. Currently, this sends the user name via the
 .Ev USER
 variable
 of the
@@ -184,9 +184,10 @@ connection to
 .Ar src_addr ,
 which can be an IP address or a host name.
 .It Fl x
-Turns on encryption of the data stream if possible.  This
-option is not available outside of the United States and
-Canada.
+Turns on encryption of the data stream if possible. This is now the
+default, so this option is ignored.
+.It Fl y
+Suppresses encryption of the data stream.
 .It Ar host
 Indicates the official name, an alias, or the Internet address
 of a remote host.