>> sending out your passwords over the web cleartext or using out of date
>> and compromised SSL

> Hmmm - I was thinking SSL takes care of this?!

Yes, unless it's out of date, compromised or not used at all :-)