The real lesson here is that when you fix your mistakes, go back and fix your mistakes retroactively!<p>AM used an insecure login token at one point, and 3 years ago they fixed it.  They switched from an MD5 of lower(pass)+username to an MD5 of the bcrypted pass+username, which is no longer reversible.<p>Apparently they never updated all of the previous login tokens though, so anyone who had created an account before the new secure system was put in place still had a vulnerable token stored.<p>When it comes to security, when you fix something - fix it for everyone people!  Even if it&#x27;s hard.<p>The good news for these folks is that the passwords revealed appear to be over 3 years old, and we all chang our passwords more often than that, right????