i will concede that my assumption about plain text storage in a database may have been a poor assumption, but it has happened before, and popular sites have been guilty. Reversibly encrypting your passwords isn't best practice, either.