When you do, it reads your password, encrypts it and compares it to the entry in the password file. If it matches, it creates a new process with st to your domain and runs a login shell in that process. Passwords should not be able to be decrypted. To crack this system you have to encrypt all possibilities and test them against the actual encrypted passwords. Passwords should never be stored in plain text anywhere in the system.
Users have to co-operate with a password system.
They should choose passwords that cannot be guessed. The Internet worm tried all variations on these, plus words in the system-wide dictionary. If data is important, it may need to be encrypted, especially if it is to be sent over a network. The DES encryption algorithm is common in the US, although it is illegal to export it. It is also suspected that the American Security Agencies are able to crack it.