It sends Base64 encoded passwords. So if you use http it is basically cleartext. You still don't need to store the passwords in cleartext, as you can use the same hashing mechanisms you would with other login methods.
back
1 comments
I thought for digest auth, it the server sends a new nonce, and then asks for md5(md5(username:password):nonce:md5(something i forget)) - you couldn't verify that unless you had access to the raw password, no?
summon @tpateck