stores passwords in plaintext