The Biggest Security Hole on the Web?