The people with the most exposure are those who use anon.penet.fi but who do not use the X-Anon-Password feature. If you use a password and This is what I don't understand about all this. I thought when Julf re-opened the service after Spaf had it closed down that time, that he made the password stuff mandatory, and you couldn't use your account until you installed a password? (If passwords *aren't* mandatory, they damn well ought to be made so immediately. This form of attack has been known about for well over a year now.) G