You are almost certainly correct in thinking that the password is stored as plain text - which is a massive no-no. Do they use HTTPS? The technique could be O

You are almost certainly correct in thinking that the password is stored as plain text - which is a massive no-no. Do they use HTTPS? The technique could be OK if this is a "second" password (you have already supplied one password and this is a second check) as it would then make it difficult for automated scripts trying to hack the site without compromising your primary authentication.