oldnavy.com (also gap.com, etc)
Clothes shopping
Old Navy (and other Gap sites) apparently store your password as plaintext.
This is doubly ironic, as I had to call Customer Service since their site currently won’t allow customers to change their email or password (the site whitescreens). When I had the agent change my email over the phone, he told me it would automatically reset my password and I’d get a notice to change it. This was a normal, and totally acceptable, expectation. What I didn’t expect was to get my old password mailed to me in plaintext. And since their site’s still broken, I’ve got no way to change it now! Awesome!
At least they claim to delete your credit cards when mailing your password. (I had no saved cards, so I can’t verify this actually happens.)