Right now, it has a constant password (bad) and communicates over plaintext even after authentication (bad).