At that point, the server will have to have received the MD5(username realm pass) at least once in order to verify the hash. You're better off not building you

At that point, the server will have to have received the MD5(username realm pass) at least once in order to verify the hash. You're better off not building your own schemes and instead trust existing solutions like SSL.