&gt; Even HTTP Digest didn&#x27;t require the password to be stored in plain text<p>As I understand it, it would still be required to store something that, if leaked, would allow anyone to create valid authentication responses?  &quot;HA1&quot; effectively becomes the password, in that leaking it is as bad as leaking the password.