I expect nothing less from Instawallet. Previously, they used to keep private keys in the URL and allowed google to index these URLs. It took a lot of pestering and hand-holding to get this fixed. I should have figured this would have happened sooner or later, given their incompetency regarding security.
If you are doing security for a Bitcoin site, your motto should be "I am an idiot and am forgetting something very basic." Then you should try to figure out how to protect yourself from your own idiocy despite being stupid.
The market can stay irrational longer than you can stay solvent. Everybody who tried to "do it right" (TradeHill, CampBX, etc.) seems to have failed while users flock to the joker du jour.
