[tsally]

Here's the sample code they give in that chapter:

    def self.encrypted_password(password, salt) 
        string_to_hash = password + "wibble" + salt # 'wibble' makes it harder to guess       
        Digest::SHA1.hexdigest(string_to_hash)
    end

They are using SHA1 with a salt, the exact method that security experts recommend against when storing passwords: http://news.ycombinator.com/item?id=995645. And obviously they didn't even use this insecure method internally.

EDIT: tptacek makes a good point. I haven't quite been fair. 37signals did what most companies never do when confronted with a security issue: they quickly acknowledged the problem, fixed it based on the suggestions of the security researchers, and moved on.

[tptacek]

You're right. Just give them credit for taking their lumps, apologizing, and getting religion.