Insecurity of Google's ClientLogin Protocol

[Alex]

Hi!

What about http://www.uni-ulm.de/en/in/mi/staff/koenings/catching-authtokens.html?
Any concerns here?

Thanks for the info,
Alex

[Mark Gjoel]

As far as I remember (I'm not sitting with the code right now) I do in
fact use an insecure line. However, I only ask for read permissions,
and the protocol you use for talking to the Picasa API is quite
secure, so if worse _should_ come to worst, you don't have to fear for
anything worse than someone being able to read your private pictures.
Complete access to your account by a third party should not be
possible.

I will however investigate this.

Cheers,
- Mark