I get annoyed with the whole "third character of your password" bit, as it means they clearly have my password saved as plain text. A decent site encrypts (makes a signature) your password when it's entered, it's only ever stored unencrypted in RAM for a fraction of a second. Then they just compare signatures.

It means it's not possible to stick the keys on a USB drive and drop it in a carpark!