Currently only lets the user view an Attach, if they have the appropiate password.
For instance. Bob has permissions for reaches the page "GroupA/ExamplePage" with the following
Bob will only see the first image. The second image will be empty (0 bytes).
Note* I used this ages ago, and have not tested this recently. I doubt it will work with the latest versions of PmWiki, though it might be worth a look at if you want something similar.
See discussion at AuthenticatedAttach-Talk