Storing the username and password in the cookie is <i>completely</i> ridiculous, but I just want to point out that it doesn't appear as though twitter itself uses SSL either.<p>Unless I'm completely missing something, neither does facebook, or reddit, or hacker news, or really any other website other than my bank.<p>edit: I had a complete lapse of thinking here and am totally wrong about this.  There are still lots of websites that do not use SSL, but twitter and facebook are not among them, nevermind.