I just want to note that passwords are not the only sensitive information that go through a server you are communicating with. Even if there were no passwords, I would consider Heartbleed just as bad.