I'm a bit tired of those "just never ever store passwords in plain text" statements applied way too much universally. Sure, for websites, most of time, bcrypt+H

I'm a bit tired of those "just never ever store passwords in plain text" statements applied way too much universally. Sure, for websites, most of time, bcrypt+HTTPS is one of the best choices. But the article in subject never mentioned that it's about the websites. One fact. Unless your ISP uses some sort of digital certificates, or authenticates you based on physical connectivity (like port number on switch, DSLAM or whatever), your ISP stores your password in plain text. And that - controversially - is a Good Thing. It's because your ISP had decided that connection-level security is way weaker than password storage security. The cables may run all over the city and they're harder to protect. The encryption takes place every time when you authenticate your connection, so nobody with a network sniffer would obtain your password easily (active attacks are still possible, but they're harder). The real rules are much more complex, based on the environment your system's working in — the connection medium, geographical diversity, supported authentication schemes and so on. The only absolutely universally true rule is "secure the whole system as much as you can, starting from the weakest link in the chain (but don't invent your own schemes)". (Sure, there are public-key crypto, zero-knowledge password proof schemes and so on - and they should be used if possible - but, for example, one the best security options a typical home router could offer for PPPoE is a CHAP with MD5 hashing as defined in ancient RFC1994.)