Amtrak.com is storing your password in plaintext

I hate to be pedantic, but just because they send you your password in plain text, doesn't mean they are storing it in plain text.<p>Does it mean they are doing a shitty job? Yes. Is storing a password using two-way encryption more secure than plaintext? Laughably. Still...

I just tried it and they sent me the same email. They don't necessarily store the password in plaintext as latch has explained.<p>They don't seem to store credit card information for future use, which is a good sign. However, they do store a lot of personally identifiable information that might make sending a password via email illegal in some states (at least Massachusetts [1]).<p>[1] <a href="http://www.mass.gov/Eoca/docs/idtheft/201CMR1700reg.pdf" rel="nofollow">http://www.mass.gov/Eoca/docs/idtheft/201CMR1700reg.pdf</a> - (3)Encryption of all transmitted records and files containing personal information that will travel across public networks, and encryption of all data containing personal information to be transmitted wirelessly.

was that your actual password you had used or a random password they created and sent you?!

I got an email like this from my domain provider the other day. I was curious if someone might be able to sniff the network for SMTP messages then go request a bunch of password resets from the website. There support staff was not too interested in the idea.