[forgotpwtomain]

> The security of passwords at rest depends on how they are stored.

Insecure passwords are insecure at rest no matter how they are stored..