[megablast]

You normally have to put in your password as well, unless you have chosen to skip that step in itunes, which seems a pretty silly thing to do.

[omaranto]

I think iTunes is the only place where I can skip a password and choose not too, out of fear of buying things by accident. I could go or a confirmation dialog instead, though.

[danielsoneg]

Yeah, but only once per 10min or so, and if you've just done an update or any of a range of other activities, that password is still valid. Once the password is in, no confirmation.

And yeah, agreed, skipping the password box is just dangerous - WAY too easy to spend money there.