You answered your own question. If a site works this way it is risking the privacy of user data on itself, but at least it isn&#x27;t endangering the credentials which may be useable to attack other sites.