Rippled: The rippled API shouldn't really have a public 'sign' method.

[ghost]

As the title describes, the rippled API shouldn't really have a public _sign_ method. The signing requires the _private key_ to be sent over the wire which is really bad practice from a security standpoint. This command should be removed early, before more people adopt this behavior and if anything, be a admin-only command.

This was reported 3 months ago via Twitter and I thought this was being worked on.

[WietseWind]

Agree! It's very easy to offer a public rippled server, setup a websocket proxy in front (eg. using NGINX) and intercept.

[MarkusTeufelberger]

It is a feature to get some donations from people that don't read documentation.

[nbougalis]

Fixed with 38c3a46a337916216a1e3ad481229fe87e07d542