It’s well known that the biggest threat to sensitive data comes from the inside. Connecting the dots, it’s not inconceivable that some insider at some Web service provider somewhere might be throwing a sniffer on the local area network to capture passwords that, in the course of their recovery, are viewable as clear text.

The risk varies from one service provider to the next and from one password to the next. For example, if for certain services you use the same, easy to remember innocuous password that, if discovered, wouldn’t matter anyway, then there’s little risk. If however, a password that also protects your access to more sensitive systems (eg: your bank) is showing up in a password recovery routine that e-mails that password to you in clear text, the risk is significantly higher.

From online service to online service, the techniques vary. For example, some will e-mail a temporary password and force you to reset it on the next login. Others will mail you a URL that you m

That's why I never put anything on my computer that I would not be let viewed in public.