Frankly, it strikes me as very odd that a company that is manufacturing a product that is supposed to help maintain your anonymity and increase your security online fails to safeguard the end-user through basic security recommendations that have been around for YEARS. Would these "holes" be plugged up as a matter of course? Something doesn't add up..... Thanks for your thorough analysis, though. This makes it increasingly clear that not every company that purports to offer "anonymous" or "secure" services can or should be trusted - even if it wasn't malicious or intentional.