It's a social news site low risk target for that sort of thing. When it started the aggregate tech level was high enough that pretty much everyone knew to use a different password on each site as a best practice. Now not so much. In any event he was busy and decided that it was a low enough risk for the password to be sent in the clear as the damage that could potentially be caused is low. (a few bunk comments, changing the email address/password, etc....) At least that is what I recall him posting here before when this question came up before.