To throw that in, there's a whole category of site that use a plain text password that can be checked by phone/re-sent back to you/printed on some statement. Wh

To throw that in, there's a whole category of site that use a plain text password that can be checked by phone/re-sent back to you/printed on some statement. While from a best practice point of view it's sub standard, the use case can be legit (in the best case your password only helps to discloses minor-ish info, and the service value is purely IRL), and you might not know in advance that they don't intend to keep your password any much safer. You have to accept that there will be plenty of online service that won't try to keep high online security and you'll have to use not too complicated, throwable passwords for every site that don't have enough stakes in protecting your auth data (I'd say basicly anything that's not monney and mail related)