North American Fruit Explorers mailing list at ibiblio

[Alan Yelvington <alany@semparpac.org>]

Hello all,

I actually READ the monthly update that 
ibiblio.org sends out each month about the 
list, and I was unpleasantly surprised to see 
that the email includes both my email address 
and password.

I have professional experience in I.T. 
security, and this is a very old behavior 
that is considered a worst-practice by 
today's standards.

_I strongly recommend that all of you create 
a password that you use exclusively for 
ibiblio.org lists until they change their 
practice._

Very bad (and very smart) people sit on the 
Internet and harvest these kinds of emails, 
and it's not at all difficult to grab the 
entire batch in one swoop and harvest all of 
the email accounts and passwords.

_How many of you have one password for 
everything?_  I thought so...

The bottom line is that the bad guys can 
search for matches with vendors, and try out 
your NAFEX password to buy on your behalf. 
That, or they hijack your email account and 
use it to spam your friends.

It's that simple.

No sense having a complicated password when 
ibiblio.org emails it to the world.

I could go on about how it's also bad that 
ibiblio.org actually has access to your 
password, but why belabor the point...

_Anyway, change your password to something 
unique to NAFEX unless you're a risk taker_.

Al Yelvington
Russell, PA