I seem to find myself doing this a lot. Maybe there's something about colleges and universities contracting out to bad webdev firms, but I've emailed 3 different firms to complain about them holding passwords in plain text.
One of them, UCAS has the majority of my personal details, and refuses to acknowledge that it's bad that they send your email, password and ID number in an unsecured email when you go through a 'lost password' form.
At the end of the day, I want to help firms improve their software, for their sake and mine, but it seems many take it personally or as if I'm discrediting the company when I point out a flaw.
I always emphasise that I'm reporting it as I want the problem to be fixed, and that I have no intention of exploiting it or sharing the details.
What can I do to increase the likelihood of a successful outcome in this situation?
Is it even my place, as a user of the system, to do this sort of thing?