Hacker News Reader

What makes submitting a plaintext password in an Auth header worse than submitting a plaintext password in a POST body?

there's no way to log out, the browser has to store it instead of a session cookie which can be invalidated if it's stolen.

Thanks, I didn't realize that the password was re-sent for every request to the site.