One of the websites I tried to use for a free PHP host was IsMyWebsite. Well, I’m glad I did, because I got to be witness to one of the most ridiculous security failings ever.
Previously I already had to complain about their passwords being passed from page to page through GET headers, they’ve outdone themselves. This morning I and every other IsMyWebsite user was sent an e-mail for forgotten passwords suggesting we choose just one of the accounts registered under our e-mail…which included every username and password for the site.
And in case you’re wondering, the change password form doesn’t work.