[nwjsmith]

This is from May, and 37signals just made a fairly large change to their authentication system (I think its called Launchpad). Their password recovery system now works differently than described in this post, so I doubt they're still storing them plaintext (thank goodness).

[revetkn]

Yeah, it may work differently now, but I think the point still holds. I understand that engineering's all about tradeoffs and being practical with your time, but things like plaintext passwords are unacceptable (IMHO) in even the first cut of a production system, let alone an established one with a large userbase.

[runevault]

Yeah, however the point stands that it proves they are willing to act this way about things that are too important to treat said way.

Goes to show even good advice can be taken too far.

[almost]

As I understand it they changed how they did things in response to the linked blog post.