Look, the reason I use a single password for most of the sites I visit is that I don't care if you figure out my password for those sites. So yes, if you run a

Look, the reason I use a single password for most of the sites I visit is that I don't care if you figure out my password for those sites. So yes, if you run a site that wants to steal my password, you can do all sorts of things pretending you're me, such as downloading copies of mysql, posting to a few random message boards, watching my Hulu favorites, etc. None of which are things I care about. That's why they all get the same user/pass. Because I don't want to spend even one second dealing with user/pass stuff for sites where security is not an issue. Now, if you did somehow manage to get my Techcrunch password or whatever, you still wouldn't be able to log into my Gmail account, Bank, or anything I care about because I have strong passwords for those. Notice how there is no technical solution to the above because there is no technical problem above. For 90% of the sites you need credentials for, those credentials just are not worth bothering to secure.