You might be interesting in Plain Text Offenders' browser add-on. It warns when you're browsing a site that is known to store or send passwords in plain text: http://plaintextoffenders.com/
This site, while clever, is spreading potentially bad information. For instance, ive worked for plenty of companies that send out site-generated passwords. The password is stored encrypted and sent out once to the user. While not the most secure, an attacker still wont be able to get to all of the plaintext passwords if they cracked into the database.
If they can crack the database, what's preventing them from getting the key used to encrypt the database?
When i say encryption, i mean 1-way encryption like bcrypt. So they could get the hashes, but would still have to somehow brute-force it.