By being vague about their claims, they are also being unclear on what should be done to fix the issue. Maybe in some cases, the offending websites even feel th

By being vague about their claims, they are also being unclear on what should be done to fix the issue. Maybe in some cases, the offending websites even feel they don't need to do anything. I can already imagine some reactions: - "I'm not storing the password in plain text, I'm hashing it after sending the email confirmation" - "I'm not storing it in plain text, I'm encrypting it." And of course, they would entirely miss the point that the real issue is that they are sending the password by email.