Good point. Session cookies bad; news at 11. Where I work, we use session cookies unencrypted too, but we also a) don't really have any sensitive info, and b) ask for the previous password when the user wants to change it. This is the first time I've heard of a problem where more sensitive stuff is linked to a single session cookie over a non-encrypted connection; maybe this will alert web types to avoid that kind of design in the future.