My domain provider asked me for the first four letters in my password when I contacted them on the phone earlier, to try and resolve a problem at their end.

Presumably that means they store passwords in clear text, right? If so - that's... well, bad - isn't it?