I think the password and the user id may be stolen by sniffing packets.
Do you use any secure tunnel to communicate with server machine?
This comment is just my interesting.