User passwords are stored in the world readable file.
vulners.com/securityvulns/securityvulns:doc:7929