I would agree, the current implementation of the PogoPlug WebAPI for user login is very poor. Even if the request is made over HTTPS, the URL is still not encrypted, so the password is in the open.

They should follow the common aproach that many other web service APIs use, and provide users with a Secret Key and a Public Token through the my.pogoplug.com site. Then with these, developers can use these to create a much more secure connection instead of passing actual creditals.

Examples of this approach can be found here:
http://www.flickr.com/services/api/auth.spec.html
http://www.dropbox.com/developers/start/authentication
http://code.google.com/apis/maps/documentation/webservices/#GettingKeys

-MindCore