I agree. I didn't mean to imply it was. I was just carrying your argument
about the server to the client side as well.
>
> > BTW: there is advantage to running Digest (instead of Basic), even
> > with the weakest options, inside of TLS. Basic exposes your password
> > to the server, whereas Digest server can store hashes of passwords
> > that are realm specific, and so use of the same password in multiple
> > realms isn't as big an exposure.
> > ...
>
> I agree that there are a lot of benefits with using Digest, but to
> interface to an existing non-MD5-based authorization system you need
> to use Basic so you have the original password text to work with.
Sorry, I'm not sure I understand that.
If it means that there needs to be a way to set the password originally, and
to change the password later, neither of which are specified by the Digest
protocol, you're right. I don't think those considerations means that one
requires the use of Basic auth, though -- it has the exact same issues.
Paul