I wish that content aggregators could use something like Kerberos tickets to delegate authentication. That way Mint could have a read-only ticket to access my bank that didn't require my password.

I still use Mint though. I asked them about their security measures in this thread: http://satisfaction.mint.com/mint/topics/can_i_trust_the_sec... . Their response was that you're not liable for fraud if you report it to your bank promptly, and Mint's reporting features make it more likely that you catch the fraud early enough to report it. It seems like a good security tradeoff to me.