Say, remember a few days ago when we mentioned that Apple had fixed a security flaw in its web site that allowed clever but naughty people to take control of any Apple ID by arbitrarily resetting its password? Well, it looks like reigning anti-security king Microsoft decided it didn't like Apple horning in on its action. According to faithful viewer Sam R., CNET is reporting that a similar security flaw to Apple's was recently uncovered with Microsoft's Passport service-- similar, but potentially about a gazillion times worse.

Apparently somebody discovered that stringing together a specific URL with a couple of known email addresses allowed him to reset the password of any Passport account he chose. And while it does sound like the same basic flaw as discovered with Apple's ID system, there are a couple of important differences. The first is that Passport accounts apparently contain a lot more sensitive info than Apple IDs-- for instance, full credit card info. So whereas the Apple flaw potentially allowed someone to buy a few Boyz II Men songs via One-Click at the iTunes Music Store, the Microsoft flaw allows naughty people to run rampant with your entire line of credit. So, yeah, Microsoft wins on that point.

And then there's also the issue of punishment. Faithful viewer Sam Beard noticed an Associated Press story that reports that, in response to past security sloppiness with Passport, Microsoft was ordered by the FTC to enact "reasonable safeguards to protect personal consumer information during the next two decades or risk fines up to $11,000 per violation." Well, the FTC is investigating this latest snafu, and apparently "each vulnerable account could constitute a separate violation." Which means that Microsoft is theoretically accountable for fines ranging up to $2.2 trillion.

Of course, since this is Microsoft we're talking about, instead of paying $2.2 trillion, they'll wind up being ordered to pay a $50 fine and attend mandatory traffic school. But still, it's the thought that counts. As for Apple, well, this has shown that it's still got a long way to go before it even comes close to catching up to Microsoft's security-themed ineptitude. It's nice to have goals, though, right?