I'm a software developer but I'm marking my niche in secure development. It turns out that while using WebScarab, I discovered that a popular user group site doesn't appear to properly take care of web passwords: The login page is http, but the submit button links to an https link.
Using WebScarab I captured the password in plaintext form... meaning to my eyes, that my message will be sent as plaintext, unless WebScarab is looking at this input BEFORE it encapsulates it via https.
In any case, this makes me VERY uneasy staring at plaintext in the http request...
Are my worries founded here? What should be my next step? (I've already reported this to the vendor.)