Desktop

Yes this is a security hole
Yes they are sending the password clear text

Yahoo is aware of this and they don't care. Here are some snippits from their web site, talking about Security and Yahoo Messenger:
"Yahoo! Messenger is intended to allow users to engage in private conversations. However, this does not guarantee that your conversation will never be available to others..."
"If your organization uses a firewall, your administrator may have the ability to review any of your network traffic and content, including any instant messages you send. If you are concerned about this, you should discuss this with the organization giving you Internet access"
"In addition, it is possible, although rare, for someone to capture your Messenger login name and password information as it passes through your organization's network or as it crosses the Internet. Please remember to "Sign Out" at the end of your session. You should also periodically change your Yahoo! password and check your Yahoo! account information, to make sure it is accurate, and that no one has altered your account."

So, yes, Messenger is not secure.
Here is the URL with this document:
http://help.yahoo.com/help/us/mesg/mesg-07.html
(please remove any spaces)

This question was closed by the author