OAuth is propagated as secure

[anonymous]

In JOSM startup page, OAuth is propagated as alternative if I dont like my credentials to be sent in plain text.

This ist very misleading, as with OAuth, my credentials are also sent unencrypted. When talking about security, It's no matter if credentials are sent once or every time. Sending them over the net is sending them over the net. As OSM does not support any encryption, so we should not draw a picture of a secure authentication with OAuth.

I consider this a security bug (in the Startup Notes, not in JOSM).

[Gubaer]

Somebody (probably you) has already fixed this in the StartupSource.

Closing as fixed.

[anonymous]

No. I removed the word "sichere" from the german version of the newest tagline.

But below, there is a multilingual statement that if you don't want to have your credentials transmittet in plain text, you should use OAuth.

[Gubaer]

Changed it into "you may consider to use OAuth". Everything else is describe in the help page for OAuth. And JOSM at least twice displays a warning that userid/password might be transmitted unencrypted, even if using OAuth.