I should have used https://www.debian.org/ in the original mail. Sorry. Everyone who can (legally) use ssl should use that URL.
Additionally, I have asked for a page to be linked from db.debian.org to describe what those who have lost their password should do. Someone else will have to explain what to do in the case where you have no account on master. Jay Treacy
