Any plaintext-equivalent protocol (including the recommended http digest) will be susceptible to a wide range of attacks. For digest, authentication, there's chosen plaintext Attack, man in the middle, online dictionary attack, and others. And, given enough motivation, there will certainly be someone to carry those attacks. So security is never too much. And I think we're responsible to use schemes that are harder too break, once they are known.
These days when I need a simple auth protocol (one that doesn't require a trusted third party), I stick with Stanford's SRP. It's a zero-knowledge protocol (the client doesn't leak any information about the password, not even to the host, except the fact that it knows it). At first this looks like black magic, but in the end it's easy to understand (and implement).