blogged: no plaintext passwords