From Leo's mailbag:
> From: A Computer User
> Sent: November 11, 2008
> To: Ask Leo!
> Subject: How can Facebook send me my password?
>
> Leo,
> If your saying that all passwords are encrypted then how does facebook
> know your password, and sends it to your email account when you forget
> it?
If they actually send you your real, current password then they
(hopefully) keep it encrypted, and decrypt it to send to you.
IMO that's a very bad approach from a security perspective.
--
Thanks for asking,
Leo Notenboom