It's not a problem for me, but I'm thinking bigger. IMO we need very strict rules to keep normal users from compromising themselves, and there's a sort of herd immunity that comes from everybody following these rules. No service should ask for anyone's password to another service, ever. Even if OAuth isn't available, just say no.