[Standards-JIG] JEP-0077: In-Band Registration

[Piotr Szturmaj]

Hi,

JEP-0077 says that passwords are sent plain. Why not hash them and store 
hashes only? Plain text password is a big lack of security, any person who 
have database access could read user's passwords. Also client application 
must store plain/encrypted password which can be readed anyway since it 
isn't one way encryption like hash.

-- 
Piotr Szturmaj
gacek999 [at] tlen [dot] pl