North American Fruit Explorers mailing list at ibiblio

[Claude Jolicoeur <cjoli@gmc.ulaval.ca>]

You are totally right, Al.
But hopefully, most will have done like me, and 
just leave this automatically generated password 
there for the list, knowing that, in the unlikely 
eventuality I ever need it, I can retrieve it from this email!
Cheers,
Claude

Le 12:20 12.12.01, vous avez écrit:
> Hello all,
>
> I actually READ the monthly update that
> ibiblio.org sends out each month about the
> list, and I was unpleasantly surprised to see
> that the email includes both my email address
> and password.
>
> I have professional experience in I.T.
> security, and this is a very old behavior
> that is considered a worst-practice by
> today's standards.
>
> _I strongly recommend that all of you create
> a password that you use exclusively for
> ibiblio.org lists until they change their
> practice._
>
> Very bad (and very smart) people sit on the
> Internet and harvest these kinds of emails,
> and it's not at all difficult to grab the
> entire batch in one swoop and harvest all of
> the email accounts and passwords.
>
> _How many of you have one password for
> everything?_  I thought so...
>
> The bottom line is that the bad guys can
> search for matches with vendors, and try out
> your NAFEX password to buy on your behalf.
> That, or they hijack your email account and
> use it to spam your friends.
>
> It's that simple.
>
> No sense having a complicated password when
> ibiblio.org emails it to the world.
>
> I could go on about how it's also bad that
> ibiblio.org actually has access to your
> password, but why belabor the point...
>
> _Anyway, change your password to something
> unique to NAFEX unless you're a risk taker_.
>
> Al Yelvington
> Russell, PA