Affiliate program security?

[Libertine]

Is it just me or is the security of affiliate programs extremely bad in many cases? Most don't use SSL when logging in, don't use encryption on stored passes, and very often allow people to change info from within the stats area without any different type of confirmation. Or they allow people to send changes in payment info through email, without actually confirming it.
(I actually tried a few times to change my account info on affiliate programs by sending an email with a spoofed "From:" field, and it worked in all cases. Anyone could do that, even with other people's accounts instead of their own)

[shitstain]

Is it just me or is the security of affiliate programs extremely bad in many cases?

No, it's not just you

[Sly_RJ]

Last time I logged into TCG their login system really pissed me off. It seemed as if they were using GET because I could see both my login and password in the URL. I sent them an email about the problem, listing various problems this could cause (people changing your mailing information and password) but the tech who replied to my email didn't seem to care since all account changes are "verified".

I hope they've changed it since then...

[bigdog]

very bad when you consider you ssn number is in there and maybe your bank wire info

[Libertine]

So why isn't anything being done about it?

I and several other people I know have all had our account info for an affiliate program changed by someone else at one time or another. I myself am paranoid about it, and check it almost daily, so nothing happened apart from me changing every password I had. But still, it seems ridiculous that so little is done to prevent this sort of thing...