they failed to mention that malicious code was reading plaintext passwords though