So save yourself some headaches and searching, and put the following in your root .htaccess file:

Just make sure those files (error.html) actually exist.

I don't exactly know why this works, but it does. I also don't know who is to blame. Textpattern blames Apache configurations for not having valid error documents to serve (they also have the solution). Dreamhost blames overly aggressive rewrite conditions, but I don't know about that either. Seems to me the rewrite conditions are being used correctly. Sure, the requested uri needs authentication, but it exists on disk. Props to other folks too for other ideas, and the final solution.

All the security articles I've read recommend setting up basic authentication. I understand that the point is to have password protected access, but basic authentication is not secure. When your browser is challenged with the basic authorization protocol, the user name and password you enter is just base 64 encoded. If someone intercepted a request header on the way to your server after you've authenticated, there would be virtually no work at all involved in decoding your user name and password.

Alternatively, and just as easily, you can use digest authentication, which is considered to be much more secure than basic. It uses MD5 encryption, and other techniques to make the output nearly one way.

Consider the following exceprts from a .htaccess file:

Both should be fairly easy to setup with the Auth directives, and Apache ships with CLI tools for easily adding users and password files: htpasswd, and htdigest.