well http digest auth is stupid. it looks more secure because the password is not sent unencrypted over the wire. however it still is bad.

kerberos or even basic auth (because the password can be checked on the server against a real algorithm) would've made this impossible.