North American Fruit Explorers mailing list at ibiblio

[Elizabeth Hilborn <ehilborn@mebtel.net>]

I totally agree Al. I believe that this practice is the source of seeing 
my NAFEX password at the time associated with my name publicly in a 
Google search a couple of years ago. Very sobering experience!

On 12/1/2012 12:20 PM, Alan Yelvington wrote:
> Hello all,
>
> I actually READ the monthly update that
> ibiblio.org sends out each month about the
> list, and I was unpleasantly surprised to see
> that the email includes both my email address
> and password.
>
> I have professional experience in I.T.
> security, and this is a very old behavior
> that is considered a worst-practice by
> today's standards.
>
> _I strongly recommend that all of you create
> a password that you use exclusively for
> ibiblio.org lists until they change their
> practice._
>
> Very bad (and very smart) people sit on the
> Internet and harvest these kinds of emails,
> and it's not at all difficult to grab the
> entire batch in one swoop and harvest all of
> the email accounts and passwords.
>
> _How many of you have one password for
> everything?_  I thought so...
>
> The bottom line is that the bad guys can
> search for matches with vendors, and try out
> your NAFEX password to buy on your behalf.
> That, or they hijack your email account and
> use it to spam your friends.
>
> It's that simple.
>
> No sense having a complicated password when
> ibiblio.org emails it to the world.
>
> I could go on about how it's also bad that
> ibiblio.org actually has access to your
> password, but why belabor the point...
>
> _Anyway, change your password to something
> unique to NAFEX unless you're a risk taker_.
>
> Al Yelvington
> Russell, PA