Hmm... I guess you have a point there. It's frustrating a bit as a developer because in all likelihood if they've done their jobs as developers they DON'T have access to your password at all. The problem is how do you trust a new site when there are obviously some (many?) out there that still use plaintext for passwords? Anyone have a solution for that? Some type of security audit w/a badge that your site can display saying "Hey, we DON'T store your password or have access to it!"

What would you say if they instead used some form of OpenID system (RPX Now or something) so you didn't have to give them your password? Would that help?