True, but read the comments. The organization reporting this is little better. ("Encrypted on the client" - which means they would be horribly exposed to man-in-the-middle attacks...)