I agree, the main issue here is that they're not using SSL during these steps, a...

wysiwtf on May 27, 2009 | parent | context | favorite | on: How Not to Do Web Site User Registration

I agree, the main issue here is that they're not using SSL during these steps, and the second is that they don't recommend changing your password from the generated default.