Comment by creshal

> At no time is the plain text password stored anywhere

Hopefully. When I see rules limiting passwords to 16 characters and disallowing SQL special characters, I'm having doubts.