Sherlock sends users’ email addresses to use as passwords for Web sites, Macwelt, Germany's Macworld reports.

When downloading files through FTP, Sherlock logs-on anonymously, but provides the user's email address as the login password.

This threat to users' privacy goes against the prevailing trend for security among Internet users, industry observers claim. Most FTP-supporting applications give users the option to choose whether to disclose their email address or not. Last month, developer Brad Pettit discovered that the iTools browser plug-in transmits the user's password in Plain Text.