Comments on: Insecure usernames and passwords on Netvibes http://paulmwatson.com/journal/2007/11/05/insecure-usernames-and-passwords-on-netvibes/ The journal of Paul M. Watson Tue, 02 Dec 2008 16:03:14 +0000 http://wordpress.org/?v=2.7-beta1 hourly 1 By: dara http://paulmwatson.com/journal/2007/11/05/insecure-usernames-and-passwords-on-netvibes/comment-page-1/#comment-12283 dara Wed, 14 Nov 2007 01:03:02 +0000 http://paulmwatson.com/journal/2007/11/05/insecure-usernames-and-passwords-on-netvibes/#comment-12283 Well spotted. This is crazy.<br><br>For something crazier, see <a href="http://Wordpress.com">Wordpress.com</a>, a very popular blog site, with plain text login data sent to an http endpoint from their https page !<br><br>Madness.<br><br>Worse now imo, folks are using their <a href="http://wordpress.com">wordpress.com</a> blog address as an OpenID.<br><br>Kinda mental to think that if you make the mistake of posting about, say your ski holiday in St. Anton from a Café while your there, somebody could sniff your password, and have access to all the on-line services you use OpenId with.<br><br>I have emailed Wordpress, and posted on my test blog there, they have not responded, and today it's still not fixed ! Well spotted. This is crazy.

For something crazier, see Wordpress.com, a very popular blog site, with plain text login data sent to an http endpoint from their https page !

Madness.

Worse now imo, folks are using their wordpress.com blog address as an OpenID.

Kinda mental to think that if you make the mistake of posting about, say your ski holiday in St. Anton from a Café while your there, somebody could sniff your password, and have access to all the on-line services you use OpenId with.

I have emailed Wordpress, and posted on my test blog there, they have not responded, and today it’s still not fixed !

]]> By: dara http://paulmwatson.com/journal/2007/11/05/insecure-usernames-and-passwords-on-netvibes/comment-page-1/#comment-14166 dara Wed, 14 Nov 2007 01:03:02 +0000 http://paulmwatson.com/journal/2007/11/05/insecure-usernames-and-passwords-on-netvibes/#comment-14166 Well spotted. This is crazy.<br><br>For something crazier, see <a href="http://Wordpress.com">Wordpress.com</a>, a very popular blog site, with plain text login data sent to an http endpoint from their https page !<br><br>Madness.<br><br>Worse now imo, folks are using their <a href="http://wordpress.com">wordpress.com</a> blog address as an OpenID.<br><br>Kinda mental to think that if you make the mistake of posting about, say your ski holiday in St. Anton from a Café while your there, somebody could sniff your password, and have access to all the on-line services you use OpenId with.<br><br>I have emailed Wordpress, and posted on my test blog there, they have not responded, and today it's still not fixed ! Well spotted. This is crazy.

For something crazier, see Wordpress.com, a very popular blog site, with plain text login data sent to an http endpoint from their https page !

Madness.

Worse now imo, folks are using their wordpress.com blog address as an OpenID.

Kinda mental to think that if you make the mistake of posting about, say your ski holiday in St. Anton from a Café while your there, somebody could sniff your password, and have access to all the on-line services you use OpenId with.

I have emailed Wordpress, and posted on my test blog there, they have not responded, and today it’s still not fixed !

]]> By: dara http://paulmwatson.com/journal/2007/11/05/insecure-usernames-and-passwords-on-netvibes/comment-page-1/#comment-5438 dara Tue, 13 Nov 2007 20:03:02 +0000 http://paulmwatson.com/journal/2007/11/05/insecure-usernames-and-passwords-on-netvibes/#comment-5438 Well spotted. This is crazy. For something crazier, see Wordpress.com, a very popular blog site, with plain text login data sent to an http endpoint from their https page ! Madness. Worse now imo, folks are using their wordpress.com blog address as an OpenID. Kinda mental to think that if you make the mistake of posting about, say your ski holiday in St. Anton from a Café while your there, somebody could sniff your password, and have access to all the on-line services you use OpenId with. I have emailed Wordpress, and posted on my test blog there, they have not responded, and today it's still not fixed ! Well spotted. This is crazy.

For something crazier, see Wordpress.com, a very popular blog site, with plain text login data sent to an http endpoint from their https page !

Madness.

Worse now imo, folks are using their wordpress.com blog address as an OpenID.

Kinda mental to think that if you make the mistake of posting about, say your ski holiday in St. Anton from a Café while your there, somebody could sniff your password, and have access to all the on-line services you use OpenId with.

I have emailed Wordpress, and posted on my test blog there, they have not responded, and today it’s still not fixed !

]]>