It seems like they "fixed" people being able to read the passwords by replacing ...

		jmediast on Sept 21, 2012 \| parent \| context \| favorite \| on: Pandora doesn't hash their passwords It seems like they "fixed" people being able to read the passwords by replacing the the form value with __USE_EXISTING__... It's still trivial to automate account takeover though. Here's a PoC to take over pandora accounts on your network using MITMProxy and Tornado: https://github.com/JackWink/Pandora-Account-Takeover-Tool