Hackers can steal your AppleID in 10 seconds (shootitlive.com)

"ask the user to login to apple with the url you sent them"

Why not just say, "Ask the user for their password" ?

This is a huge security issue. I imagine that someone post this on Facebook and encourage others in the same school (on same wifi) to log in to their AppleID. In this way you can access other people's accounts directly. Buying things at store.apple.com, AppStore, iTunes.