Here's an idea/meme: Create a way to describe both the password rules and storage policy for a web site in a few characters.
Then encourage sites to put those characters next to the "Enter Password" box on their site. The intended effect is to make users
aware of the rules of the site, and ultimately to force them to improve their policy. Here's an example of what I mean:

0 means "we store your password in the clear"
1 means "we encrypt your password using standard techniques"
2 means "we one-way encrypt your password and store only the encrypted value"
3 means "we one-way encrypt your password with salt, and store only encrypted, salted value"
4 means "3 and also we have an effective means in place to prevent repeated guessing by an external agent"
                                                  (some sort of time-delay for bad guesses, getting progressively longer, or something similar..)

(Any more needed?)

and maybe use a letter for the password policy:

A means "password has a short maximum length" (8?) and silly constraints on what characters must be present"
C means "No restriction on password length, but some constraints on characters" ....
Z means "Password can be arbitrarily long and include any character you can type."

So 0A would be a disaster, and the goal would be to move sites toward 4Z. And you'd see what the site does
every time you log on (assuming, of course, that they're honest, but this would be easily auditable..) Even people
who didn't understand what the specifics mean could be educated to know that closer to 4Z is better. (This is just
an example... I'm sure a better encoding is possible...)

It is hard enough to know if I should trust my child, and I raised him. He doesn't
tell me much. App developers tell me less, and some of them are devious. This is not
a good security model. And Google knows better.

The heading says 50,000, which is pretty crazy.. but all of the text refers to numbers more like 5,000....

I don't want to cast aspersions (or worse!) on your experts, but in my experience most of those
people (especially architects) never go back to see how what they built is working out, what they did
wrong, what could be improved in their next project, etc. I'm sure there are some who do, but it certainly
is not standard practice, so you're wise to ask the slashdot crowd for real experience.

.. from a company called Earth Class Mail. They receive your mail, send you an image of the envelope, and let you tell them what to do with it: shred it, recycle it, open and scan contents and send PDF, deposit check, etc. The company was the subject of a sort-of documentary last year.