It's what the crypto guys have been saying all along.

Use bcrypt, use scrypt, etc. This article just provides a nice analysis of exactly why it's so important not to invent your own. :)

@JoshJones Tell him to put the website on Plaintext Offenders.

The fact that he recognized sending a password back to him in plaintext is something noteworthy means he's a least not as dumb as the average luser. :P

It's sad how many sites don't take security even remotely seriously. I mean here we are saying "use bcrypt use pbkdf2 blah blah blah" and we get all pissy when a site uses a plain, single-iteration hash (or god forbid, an unsalted hash) while there are websites that don't use any hashing...

What website was it?

Please do. It would be great to add it to the website.

(Is the site down?)

Odd, got a bunch of server errors. I wonder what kind of "detailed information", as they say, is collected.

inb4 they pull a twitter and log my password in plaintext.