Right, and that default should probably be changed.

But that doesn't justify this clickbait title which is simply untrue as nowhere in the report does it say that passwords are shared "everywhere."

Also, not making the distinction between http/https allows retrieving most passwords if you can man-in-the-middle