The only security threat would be the site itself. How do they know other users have the same password?

Options:

• They have your password in plain text in their DB. CHEFF KISS

• They aren’t using salts.

• They are using the same salt for everyone.

All of them concerning.