Recently, on live chat, a representative of a web hosting company (will not disclose the company name for liability issues), asked me for my password to the server in plain text in order to verify the identity of the account holder (me)
He then proceeded to tell me that "your password does match it" -- He's reffering to the password I sent him over HTTPS.
Should I be changing my password every time I make a support request?
Furthermore, they MUST be storing passwords for user accounts in plain-text somewhere, correct?
This seems like a major compromise of security for their customers