I completely agree with Balazs, that if you want a secure site, then you should pump all traffic over SSL, or just the parts of the site which need to be secured. All other forms of javascript og digest security won't do the job (they all have some sort of weakness). It has nothing to do with going around a weakness of the application. The weakness is that someone doesn't know how to secure his/her site with SSL. This of course, can be solved by the community of eZ by contributing documentation on how to install eZ publish by using SSL.
Lars, there are many weaknesses, not "the" weakness.
Most users of eZPublish will not use SSL. This is one reason why it is important for eZPublish to provide good security by default.
Another reason is that there are some practical problems with requiring users to use SSL to solve security problems. One problem is that the users have to evaluate the security / speed tradeoffs themselves, but they are not necessarily experts in eZPublish so they won't know the security tradeoffs very well. Another problem is that it is very easy to mess up the installation of SSL in such a way so as to do nothing to aid security, especially if one tries to secure only part of the site (which is exactly what someone would want to do if they wanted to use SSL to address only this vulnerability without incurring performance penalties for the rest of the site).
I do agree that it could be helpful to have documentation for users about how to use SSL with their eZPublish sites. In my opinion this documentation is a completely separate issue.
Here is a page that talks about how to do digest authentication from php (the source language of eZPublish): http://www.php.net/manual/en/features.http-auth.php