I’m surprised how many major sites store passwords in plain text (and email them to me, instead of resetting them).