Answer
Your user name and password are sent to the Authentication Web Service over HTTPS, an encrypted connection. The Authentication Web Service returns an encrypted authentication token which is used to access other ArcWeb Services.
When sent through ArcGIS, the user name and password are sent using both HTTP Digest Authentication and HTTPS.