Analytics services are unintentionally collecting a mass of passwords and other sensitive data, new research shows.