What does this mean for HTTP basic authentication? How about digest access authentication?
Digest authentication is safe against passive sniffing (it doesn't exchange any password/token in the clear and uses nonces), but it doesn't protect against active attacker who could modify server headers and replace "Digest" with "Basic" to reveal password.
If so, why don't facebook et al. switch to digest based authentication?
Surely its better than unencrypted cookie based logins. Is it just that its ugly (the browser login popup)?
Terribly bad UI and lack of standard way to log out are dealbreakers for HTTP auth.
There's also no reliable way to customize UI to offer help, password reminders, branding or anything like that.
There has been proposal to improve this in 1999:
http://www.w3.org/TR/NOTE-authentform
and recently discussed in HTML5 WG, but the conclusion was Digest and countless JS tricks proposed in its place are only partial solutions, cookies have unstoppable momentum, so it's better if everyone just switches to SSL.