I was just wondering if it's legal to store/log mistyped passwords and how many of you have seen this happen in a log file or db?

EDIT: so what I understand from your comments is: legal depends on what country (could have thought of this myself) but it is a big security risk in any case... thanks