That will tell you whether they send the password in clear, not whether they encrypt it. The only information you'll have is:

IF (they send you the password in clear) THEN (they don't use a one-way hash)

There is no other information to be derived from this method of checking.

(? as my knowledge on security is somewhat limited)

> But if they use a two way cipher and the server is compromised one would presume the mechanism for un-encrypting [decrypting] the passwords would also be compromised meaning it is almost as bad?

It might be. It is conceivable that a site may use public key cryptography and store encrypted passwords, but have password recovery done on an independent system which has the decryption key.

(For our purposes, a "reset question" might also be considered a password because it is still something "you know" and to be differentiated from an email address which would be something "you have")

Nevertheless, the idea of a password question is so useful that I still support it on my sites. But our implementation is open-ended: you define your own question as well as its answer. I think this is better for anyone who is security conscious, but unfortunately it still allows the lazy or ignorant to be insecure.

However, a mechanism for sites that use the standard questions is to manufacture a set of fictitious names and use those everywhere. e.g. Father's name - "Keyser Soze". First car make and model, "Millennium Falcon", etc.

There is the overhead of remembering these but that is not too hard with some thought and repeated use.