Be that as it may, we also see time and time again that even major sites still screw up the very basics covered by OWASP.

Did we not just yesterday or today discuss a bank that sent credentials in clear text?