[Oni]

At least they are not plain text
Bcrypt hashing is so slow that nobody will bother cracking the hashes

Yes, storing user-credentials In plain text Is just sheer stupidity.

During my exploitations, you wouldn't believe how many passwords and PIN codes I've comes across In plain text. I have hundreds on hand from Individual sites- all saved with unedited screenshots. Bcrypt (key stretching) can prove to be quite effective against bruteforcing and the like, even when powerful GPUs are used In attacks. On topic, DailyMotion's security breach just demonstrates that the nature of the website (pretty much superior on securing It's data), has no bearing against dedicated hackers and attacks. That Is, anyone and anything with an Internet connection Is vulnerable to exploitation.

We use Bcrypt as well.