title: Is Apache Digest authentication more secure or than Basic or not?
body: <p>On the <a href="http://httpd.apache.org/docs/trunk/howto/auth.html">Authorization intro</a> page, Apache tells us that:</p>
  
  <blockquote>
    <p>Apache supports one other authentication method: AuthType Digest. This
    method is implemented by mod_auth_digest and <strong>is much more secure</strong>.</p>
  </blockquote>
  
  <p>while on the <a href="http://httpd.apache.org/docs/trunk/mod/mod_auth_digest.html">mod_auth_digest</a> page, Apache tells us that:</p>
  
  <blockquote>
    <p>This module implements HTTP Digest Authentication (RFC2617), and
    provides an alternative to mod_auth_basic where the password is not
    transmitted as cleartext. However, this does not lead to a significant
    security advantage over basic authentication. On the other hand, the
    password storage on the server <strong>is much less secure</strong> with digest
    authentication than with basic authentication.</p>
  </blockquote>
  
  <p>Can someone clarify these seemingly contradictory statements for me? I understand that both ways of handling passwords are vulnerable to replay attacks (unless you're also using SSL) but that seems like a separate issue.</p>