[mbesto]

I'm actually curious about this. How do popular web apps store your id/pw for other sites? I know personally that Mint (Yodlee), Zenefits, TriNet Expense, and BoA all log into other sites but I'm curious how/where they store the passwords? If they create a scraper then it means they have to store the password (encrypted) and then decrypt it so the scraper can use it? What happens if a master app (let's use Zenefits as an example) get's hacked? Are my other passwords compromised then?

[Untit1ed]

You've kind of answered your own question there - if they're able to log into other sites without using some kind of OAuth-type mechanism that doesn't require them to store your password, then a hack will compromise those passwords.