30boxes.com are a Web 2.0-style company providing a social calendar thing.

Unfortunately, for all their wizzy javascript savvy, they've made the rather schoolboy error of putting the entire account details (including password) in the confirmation URL, "protected" merely by Base64.

echo some-base64-string | perl -e '
use MIME::Base64;
$/ = "\0";
print decode_base64(<>);'

Comments