Did anyone else take a look at the site source code?
For a trap, it's pretty damn obvious. The form submits the user name and password in plain text over the "secured" connection--the one that doesn't support forward secrecy, operated by a provider who's already known to be compelled to disclose SSL private keys.
Further, I can't imagine Ladar willingly set this up. This means that not only can they compel Ladar to hand over his private SSL keys, but they can apparently compel him to take positive action to fuck over his users. <s> Talk about a free country! </s>
For a trap, it's pretty damn obvious. The form submits the user name and password in plain text over the "secured" connection--the one that doesn't support forward secrecy, operated by a provider who's already known to be compelled to disclose SSL private keys.
Further, I can't imagine Ladar willingly set this up. This means that not only can they compel Ladar to hand over his private SSL keys, but they can apparently compel him to take positive action to fuck over his users. <s> Talk about a free country! </s>