Return to Question

I'm in no way a security expert, in fact I'm just your average Joe with a question.

I was on my car insurance website, I registered and as I logged in I saw my password, not encrypted, in plain sight in the address bar.

Now this (to me) is already a threat (someone could see it over my shoulder if I was in a public space) but I wanted to know if it's a tell-tale sign of a more deep flaw in the security of this website.

If it is (let's say it can be a sign they store, or at least communicate my password, without encryption) how can I defend myself? should I ask them for more information (but I doubt they'll ever answer me).

My passwords are all different but they follow a common pattern, should I be concerned and thus change all of my passwords and the pattern?

This is NOT a duplicate of: Should sensitive data ever be passed in the query string?

In that question it's asked wether it's a good thing to pass informations in the URL WHILE DEVELOPING A WEBSITE or not. Mine asks what to do IF YOU STUMBLE UPON SUCH BEHAVIOUR

This question might be seen as a follow-up but it's not asking the same question

I'm in no way a security expert, in fact I'm just your average Joe with a question.

I was on my car insurance website, I registered and as I logged in I saw my password, not encrypted, in plain sight in the address bar.

Now this (to me) is already a threat (someone could see it over my shoulder if I was in a public space) but I wanted to know if it's a tell-tale sign of a more deep flaw in the security of this website.

If it is (let's say it can be a sign they store, or at least communicate my password, without encryption) how can I defend myself? should I ask them for more information (but I doubt they'll ever answer me).

My passwords are all different but they follow a common pattern, should I be concerned and thus change all of my passwords and the pattern?

This is NOT a duplicate of: Should sensitive data ever be passed in the query string?

In that question it's asked wether it's a good thing to pass informations in the URL WHILE DEVELOPING A WEBSITE or not. Mine asks what to do IF YOU STUMBLE UPON SUCH BEHAVIOUR

This question might be seen as a follow-up but it's not asking the same question

I'm in no way a security expert, in fact I'm just your average Joe with a question.

I was on my car insurance website, I registered and as I logged in I saw my password, not encrypted, in plain sight in the address bar.

Now this (to me) is already a threat (someone could see it over my shoulder if I was in a public space) but I wanted to know if it's a tell-tale sign of a more deep flaw in the security of this website.

If it is (let's say it can be a sign they store, or at least communicate my password, without encryption) how can I defend myself? should I ask them for more information (but I doubt they'll ever answer me).

My passwords are all different but they follow a common pattern, should I be concerned and thus change all of my passwords and the pattern?

I'm in no way a security expert, in fact I'm just your average Joe with a question.

I was on my car insurance website, I registered and as I logged in I saw my password, not encrypted, in plain sight in the address bar.

Now this (to me) is already a threat (someone could see it over my shoulder if I was in a public space) but I wanted to know if it's a tell-tale sign of a more deep flaw in the security of this website.

If it is (let's say it can be a sign they store, or at least communicate my password, without encryption) how can I defend myself? should I ask them for more information (but I doubt they'll ever answer me).

My passwords are all different but they follow a common pattern, should I be concerned and thus change all of my passwords and the pattern?

This is NOT a duplicate of: Should sensitive data ever be passed in the query string?

In that question it's asked wether it's a good thing to pass informations in the URL WHILE DEVELOPING A WEBSITE or not. Mine asks what to do IF YOU STUMBLE UPON SUCH BEHAVIOUR

This question might be seen as a follow-up but it's not asking the same question