Your messages are cleartext, can be forged, and your password can be trivially grabbed across just a few logins.

It's like pre-https internet basically.

This also means winlink shouldn't be used for PII (which is sort of important in an emergency!).

If you can at least key exchange and encrypt between you and the next node, you have some safeguards and your messages aren't in the clear - but that is currently prohibited by the regs.

I don't think scammers will be listening in on shortwave to grab names or an address during an emergency :p

Have you been to a hamfest recently? Do you want half the participants getting your details?

If you put your address on your license application, then they have your details if they have your callsign.

Security through obscurity is no security at all. SDRs that will record everything across a nice swath of frequency are $20.

+those fantastic websdr sites will have it captured

> Your messages are cleartext, can be forged

Digital signatures are permissible under the current rules and in principle avoid this issue although the software tooling around it isn't there. Similar example: Debian packages are transmitted over HTTP, but this isn't a problem because they are authenticated with GPG.