ok last question security n' dovecot

[Jonathan T. Steadman]

I set up dovecot and all is well, but before I decide that maybe I will
set something up outside of my network, are all passwords secure? 
should I only use new created users with no special permissions?  I set
up dovecot.conf with 

auth = default
and in default {
}
the default value is md5-digest

but when I try to select that option with evolution I get this:

"unable to connect to POP server $Server_Name: no support for requested
authentication mechanism"

and it will only work on evolution if I pick "password" for
authentication.  Just wondering, I guess if this sends passwords in
plain text.