[chairface]

This bit is inaccurate, as far as I can tell:

> it was also transmitting the data in “plain text.” This would be like mailing a private letter to someone without the envelope.

My understanding is that the data was transmitted over https, which is decidedly not like mailing a letter with no envelope.

[pyre]

I think that another company brought to light during the last week was not using https. This may be adding to the confusion.

[rsingel]

Path said it was sending over HTTPS, but storing in plaintext - protected by a firewall. No server-side encryption.

[chairface]

That's still not like sending a letter without an envelope.