Answering the question instead of commenting on Ladadadada's answer as I don't seem to have enough reputation to comment directly (even though I do on stackoverflow; isn't that shared?). Apologies if this is a breach of etiquette!
I'm the author of passwordcard.org. Thanks, Ladadadada, for your thorough analysis! It's the most thorough I've seen so far. Your points are valid, and I agree with your conclusions. The password card is by no means meant to be iron clad secure, it's only meant to be more secure than the current practice of many people.
I'll address some of the points you mention, such as bringing the FAQ up to date, and reducing unnecessary enabling of caching and setting of cookies. Just to explain one point specifically: the reason the site doesn't default to SSL is that Google Adsense does not work over SSL, and I need the ad revenue to pay for the hosting costs. Not the best of reasons, I admit.
If anyone has questions about me or passwordcard.org, let me know. (Probably not here though. What's the accepted way to ask specific questions of someone publicly?)