The main points from my point of view, and the reasons I think this is unwarranted paranoia:
- not a critical resource : if your email is compromised, the importance of that makes this insignificant. It's also a local resource, cannot be exploited from afar.
- just because they email it to you doesn't mean it's in plain text. It can be symmetrically encrypted, or (not in this case) it can be sent prior to storage.
Not all accounts require draconian password policies. In fact, the abuse of these requirements encourage users to make really bad decisions regarding passwords, like reusing them or having them stored in a central repository.
- not a critical resource : if your email is compromised, the importance of that makes this insignificant. It's also a local resource, cannot be exploited from afar.
- just because they email it to you doesn't mean it's in plain text. It can be symmetrically encrypted, or (not in this case) it can be sent prior to storage.
Not all accounts require draconian password policies. In fact, the abuse of these requirements encourage users to make really bad decisions regarding passwords, like reusing them or having them stored in a central repository.