So, a site that I was using to sign up for an academic conference transmits information unencrypted (HTTP), including passwords. Then I see, using the 'forgot password' function gets me an email with my password in plaintext. I understand the security implications of this - this is horrible.
My questions is, what should I do? Should I send them an email, and if so, how should I convey this information? Should I tell/warn colleagues about this?