RT @securityninja: is that demonstrating sensitive data disclosure? -> It certainly was not a phishing or clickjacking demo....