Hacker News Reader

When I am using a real Jabber client.

At work, probably.

This includes the login I guess...

can someone confirm that login info is sent in the clear? that's pretty terrible.

yep. they could have at least supported SASL to have the login info encrypted and then transport the rest of the stream unencrypted, but they did not.

They claim they're using DIGEST-MD5, so not quite plaintext, but a broken hash algorithm

http://www.facebook.com/help/?faq=16742

http://www.facebook.com/help/?faq=16741