Rok Ferguson: "What would a criminal do if they access to your card details but not your password? Of course, there’s that handy “I forgot my password” link. Let’s see how well protected that is.
 
"The first step in the password reset procedure is to enter your card number, obviously to ensure you are resetting the password for the correct account. Once that number is entered the system now requires some corroborating data to be sure that you are the legitmate account holder, let’s have a look at that “Identification” phase."

What you then discover will make you despair of the design of card security systems.

Adi Kingsley-Hughes isn't enjoying. (We haven't upgraded from Snow Leopard yet, so can't comment.)