Is a plain password in the URL a potential security threat? [duplicate]

Question

I'm in no way a security expert, in fact I'm just your average Joe with a question.

I was on my car insurance website, I registered and as I logged in I saw my password, not encrypted, in plain sight in the address bar.

Now this (to me) is already a threat (someone could see it over my shoulder if I was in a public space) but I wanted to know if it's a tell-tale sign of a more deep flaw in the security of this website.

If it is (let's say it can be a sign they store, or at least communicate my password, without encryption) how can I defend myself? should I ask them for more information (but I doubt they'll ever answer me).

My passwords are all different but they follow a common pattern, should I be concerned and thus change all of my passwords and the pattern?

This is NOT a duplicate of: Should sensitive data ever be passed in the query string?

In that question it's asked wether it's a good thing to pass informations in the URL WHILE DEVELOPING A WEBSITE or not. Mine asks what to do IF YOU STUMBLE UPON SUCH BEHAVIOUR

This question might be seen as a follow-up but it's not asking the same question

Answer 1

This is a serious security problem. URLs should never contain sensitive information.

• URLs show up in your browsing history. So even after logging out it will be trivial to access your account for anyone using the same computer.
• Commonly, web servers are logging incoming requests. Also, firewalls or proxies involved in processing your requests might maintain their own log files. In that case your credentials will show up all over these logs, increasing the risk of a leak.
• If they show you your password in plain text that probably means they are also storing it unhashed. That means, if there ever happens to be a breach of their database, your password will be disclosed.
• Many browser plugins send visited URLs to their servers, e.g. to check them against a list malware sites or just to spy on you. It's bad enough that they are able to track people's browsing behavior. With credentials in the URL it's even worse.
• Referer leaks. If they include analytics (I'm sure they do) or embed advertisement, or whenever you click on an external link, your browser typically sends a Referer header which contains the previous URL, thus disclosing your credentials to all these parties.

should I be concerned and thus change all of my passwords and pattern?

Yes, it's such a blatant flaw that you shouldn't put any trust in their systems. Sticking to your password is not worth taking the risk. It's their own responsibility to fix the application and as a user there is not much you can do about it. Kindly inform them about the problem and refrain from using their services.