Curious - Does anyone know the legality of providing a username and password and passing it through to another site that doesn't have an API/oAuth? Is it all ba

Curious - Does anyone know the legality of providing a username and password and passing it through to another site that doesn't have an API/oAuth? Is it all based on the ToS of that site? It sounds like IFTTT does it / has done it. I'm really surprised by that. Isn't this a big no-no?