If you're using SSL the password is encrypted in transit. Once it reaches the server it needs to be to encrypted at rest. When I see billion dollar companies with an ungodly IT budget not do something basic like salt and hash passwords in the database I have to wonder how they could miss something so basic.