That would be accurate if the article did not state that he used the "Forgotten password" feature to recover his password. Also, sending a password unencrypted over email even before database storage is just as concerning. What if I fat-fingered my email address?
That's right. In this case they have it in a recoverable format somewhere (symmetric encryption is not as useless as many seem to think). Thanks for pointing it out, I thing I skimmed that part this morning.
However, it is still just your wifi connection which has to be locally accessed still and not ultra-secret password. IMO the policy is not problematic and it can save you the need to write it down somewhere, which for a local-only resource might be a worse alternative.
