Using SSL on the web server is probably the best way to handle this, if it's an option for you (Katie's second link).
Once you do that, and you access the web service over HTTPS, you shouldn't need to worry about further encryption of the login data. (It's probably also worth nothing that if you pick the SSL route, it's better to send the login credentials in the request body, as opposed to in the URL - since that can be saved in server logs / browser cache or history, and things like that).