I want to talk about Security and Hosting by 1 and 1.

I recently tried to redeem PPC vouchers that I was promised when signing up for 1 and 1. 1and1's voucher request process is as follows:

1. Call the customer service number.
2. Ask for the voucher codes.
3. Tell the customer service agent your personal inforation
- Account number
- Full name
- Last four digits of the billing credit card
- Your password

I know that most reputable companies always state, "we will never ask for your password". As far as I can tell it should never be needed. Is this a security issue?

Second question, I went to change my password and noticed that it was masked. On the screen it read "Password" instead of "xxxxxxxx". Is this a security issue?

Also, the customer service person says it is displayed on her screen as well for all customer service reps, guests walking through the office, etc... to see.

This bothers me, perhaps I am just overly cautious. Does anyone have any input on this?