- clients don't send server passwords as plaintext: the server sends a nonce which the client encrypt using the password as the key - IPs are visible in netstats - amount of client jobpreferences limited to 3 at the servers side - sanitizing client names