title: Security - is it ok to send a username and password via HTTP GET?
body: <p>We are an organisation who have purchased a system which is used by doctors to view test results of patients (quite sensitive information).
  Being a programmer, I have poked and prodded with the system and found that it submits the username and password via a HTTP GET request.
  On the domain it is run on, all computers are set to bypass the proxy, so the URL with the request won't be saved in some proxy log somewhere.
  But I would argue this is an unsafe way of handling username and passwords anyway.</p>
  
  <p>The vendor will argue that since we never asked for it, it will be an 'enhancement' which will require additional $$$. (We never wrote the specifications for the system in the first place).</p>
  
  <p>What kind of case could I make to management to make them feel this isn't to standard and that probably the only way this system would be secure is through HTTPS?</p>
  
  <p>EDIT: Thanks for all your responses!
  I have raised the issue with the project leader, her response was along the lines of "what's HTTP?".
  So I plan to explain it all to her in better detail, investigate the legal implications and try to raise the issue with the programmers directly asking why they went that path.  I will also try and explain the situation to other colleagues who don't have any direct involvement but may be able to have some influence on the matter.</p>