> Even HTTP Digest didn't require the password to be stored in plain text As I understand it, it would still be required to store something that, if leaked, wo

> Even HTTP Digest didn't require the password to be stored in plain text As I understand it, it would still be required to store something that, if leaked, would allow anyone to create valid authentication responses? "HA1" effectively becomes the password, in that leaking it is as bad as leaking the password.