HTTP Digest Auth is susceptible to offline brute force attacks

Since HTTP Digest Auth uses MD5 to hash passwords it's feasible to brute-force the password database if it ever gets compromised. Current best-practice is to use a purposely slow hashing algorithm e.g. by using bcrypt.