This is common practice. Our password forms all over the internet send the password just as part of a normal request. We rely on SSL to protect that data as i

This is common practice. Our password forms all over the internet send the password just as part of a normal request. We rely on SSL to protect that data as it goes over the wire and then there are all sorts of ways that it might be stored in plain text somewhere on the servers. They could just, in RAM, take off the last 6 characters of the password they got and treat those as the token with the rest being the password itself. At this point it's not much different from passing them separately. The main point of the original rant was that we have a solution that doesn't require this, but it's not used for any websites.