Wow... not surprising but certainly informative. Another case of a software company not bothering to realize that all authentication should be secure no matter if you are "checking in" or managing your Bank Account!