Yeah, I try to minimize my exposure and only buy from Amazon, or only sources where they use a major payment processor where I'm already setup (i.e., PayPal or Amazon).
Amazon payment is basically like PayPal - they provide the backend payment processing, and as an Amazon customer, you don't have to provide your CC details to the merchant.
A merchant/online-store/etc., can use PayPal for CC payments, so you can just provide that information on the fly, or if you have PP, login and complete the transaction. Works like this:
Store connects to PP with a merchant ID number and a transaction ID (of the purchase)
PP completes the transaction, then routes you back to the store with a confirmation code
Store updates its records to reflect a successful (or potentially a denied or canceled) payment
Always be _very_ aware when you're being redirected, to confirm the site is in fact PayPal (or Amazon), otherwise you could inadvertently supply your credentials to a bogus site. I don't mean to make it sound like it happens all the time, and clearly if it's a legit storefront, they want to be paid, just always be a smart shopper.
I use two-step authorization for PayPal, so during a redirect, I login, and I have to respond with a code that's sent as a text message to my mobile