I ordered concert tickets from wantickets.com and had to create an account with a password.

They sent me a confirmation email with my password in clear-text.

I sent an email to them, a two sentence heads up that sending clear text passwords isn't a great idea.

They responded to me with the following email: 'Hi RustyJosh, Your password is - mypassword'

Me:

Also, there is an enormous security risk in storing passwords in plaintext. It is completely unacceptable (please contact system administration about this)

J:

Can you please let us know what you mean by plain text passwords? Our IT is not sure where you are getting this information.

Me:

When I request my password, it sends me an exact copy of my password. If passwords were encrypted, this would be impossible. Most websites do not send you your password back because they do not store your plaintext password, only an encrypted version. Passwords are easy to encrypt, but encrypted passwords are nearly impossible to decrypt. This is why passwords usually need to be "reset", not "retrieved". Should centerres' database, compromised, or copied by one of the database managers: the passwords of everyone who ever made an account would be plainly visible. This is a problem because many people use the same password for multiple services (for example, If I knew everyone's centerres password, I may also know their password for their gmail, facebook, or bank account). http://blog.moertel.com/articles/2006/12/15/never-store-passwords-in-a-database

D:

While I appreciate your concern, this only partly correct. Unfortunately for security reasons, I really can’t get into the details with you about our encryption methods because you are not one of my staff. That said, columnar, table, and entire database encryption as opposed to stored password hashes are all possible alternatives what you are proposing. http://msdn.microsoft.com/en-us/library/cc278098(v=sql.100).aspx

There are sites out there that advertise in-browser encryption such as MEGA and StrongCoin.

They say that people with access to the servers cannot decrypt the data. But if they have access to the servers couldn't they just change the webpage so it sends the keys back or add a javascript keylogger.

If this was to happen would an average user be able to tell?

Is there any way a website can be designed with the convenience and security offered by in-browser encryption but be resilient to changes to the pages (For example by using a hash of content of the entire page in the KDF).

A curated list of awesome search engines useful during Penetration testing, Vulnerability assessments, Red/Blue Team operations, Bug Bounty and more -> https://github.com/edoardottt/awesome-hacker-search-engines.

It contains more than 250 useful tools carefully organized in 20 categories (General • Servers • Vulnerabilities • Exploits • Attack surface • Code • Mail addresses • Domains • URLs • DNS • Certificates • WiFi networks • Device Info • Credentials • Hidden Services • Social Networks • Phone numbers • Threat Intelligence • Web History • Surveillance cameras), added 40+ entries in the last week!

If you want to propose changes, just open an issue or a pull request.