On: How Not to Do Web Site User Registration

[russell]

> An attacker which can read out the passwords from your database already owns your site.

Never store passwords in plain text. They are open to a disgruntled employee. It happens frequently enough to just not take a chance.