[jimktrains2]

HTTP Digest also makes HA1 (hash stored on the server) the credential, so if it were leaked, then you could still authenticate as the user.