As we see from this thread, people really need to stop assuming that a site will store their password securely. Find a system that allows you to use a unique, random password for each site and use that instead. Do not trust any site to store your password in a secure fashion as relatively few actually do. If someone can get into the password database on a site, it probably doesn't matter if they have your password or not, because they can usually still access everything directly anyway by looking up your user id and performing the relevant queries.
The danger in plaintext storage is that your password to other valuable sites may be exposed by a leaked database dump or similar. This is not a concern if you use a randomly-generated unique password for each site you visit.
Everything is just much safer this way. With some companies making kind of legitimate arguments for plaintext password storage, just assume that your password is NEVER secret to the admins of a site or anyone who may break in and steal their information. Things would be much nicer for everyone involved if we did this.
There are systems in place that make this pretty easy. Personally I use a home-grown method: pwgen -c xx, copy and paste the coolest-looking password displayed, email to myself encrypted, and decrypt with my secret key and copy and paste any time I want to use a site. There are also things like LastPass, KeePass, websites that generate hashes of passwords salted with another phrase or target site URL (copy and paste final output), websites that output a simple character lookup table based on a user phrase, etc. I believe that an interested party could make one of these things work well enough for use among the general people (especially with automated sync platforms from Google and Mozilla). We need to stop relying on anonymous third parties for our personal safety.
I encourage people to use SHA1_Pass. I wrote it and provide full source code under the GPL license. It's free as in freedom and beer. I use it because (as you stated) sites don't do the right thing and have other priorities.
As conscientious users and devs, we have to take matters into our own hands.
You are right. But again, speaking about Pingdom...they are monitoring company...if they treat our password in that way, how do they treat our other private data...We are putting there our http passwords, right? This is a good way to find out if you should really use some service, or not.
The danger in plaintext storage is that your password to other valuable sites may be exposed by a leaked database dump or similar. This is not a concern if you use a randomly-generated unique password for each site you visit.
Everything is just much safer this way. With some companies making kind of legitimate arguments for plaintext password storage, just assume that your password is NEVER secret to the admins of a site or anyone who may break in and steal their information. Things would be much nicer for everyone involved if we did this.
There are systems in place that make this pretty easy. Personally I use a home-grown method: pwgen -c xx, copy and paste the coolest-looking password displayed, email to myself encrypted, and decrypt with my secret key and copy and paste any time I want to use a site. There are also things like LastPass, KeePass, websites that generate hashes of passwords salted with another phrase or target site URL (copy and paste final output), websites that output a simple character lookup table based on a user phrase, etc. I believe that an interested party could make one of these things work well enough for use among the general people (especially with automated sync platforms from Google and Mozilla). We need to stop relying on anonymous third parties for our personal safety.