Private key stored in plain text

Your private key, used to sign chat messages, is stored in ".minecraft/profilekeys/(your UUID).json", IN PLAIN TEXT! This means a simple virus could quite easily steal it, because there's 0 encryption on your private key.