email password in clear text

[ispcomm]

I would cast my vote in favor of clear text passwords.

There's a very good reason to have clear text passwords on the server: This is because most challenge/response ways for autentication (cram-md5 etc) need to have the clear-text password to compute the hashes which are exchanged on the network (in clear).

Having an encrypted password to start with will limit the authentication mechanisms to plain old "plain-text" which means that the password is sent in clear on an (almost surely) unprotected channel (pop3/imap/smtp).

It's much better to have the password hashes on the network and clear passwords on the server than viceversa.

Also... if someone can peek in your databases and flat files on the server you're already in trouble beyound the simple clear passwords.

ispcomm.