2018-??-??: This site now enforces HTTPS, making the old signature-based authentication mechanisms unnecessary, but they are still there.

2013-09-01: Passwords have been deleted for the new system. You must reset your password.

Security features (because HTTP is unencrypted):

• Sessions are locked to one IP address (there is potential for session hijacking if the attacker can control your IP) and expire after 1 week of inactivity (1 hour if they are never used).
• Logins are signed with a timestamp (expiring after 10 seconds) and two random sequences that must not be used for the immediately following login. This prevents replay attacks.