Password hashing is set up. It is still lax in that accounts are created for unregistered user names, but if you have a username then it is very secure.