"Also, we encrypt user passwords on our servers and we never return a password in the result of any query."

Queue a link to _that_ bcrypt article...

I wonder if they've got a reason not to only store a hash? And if so, I wonder if they've got infrastructure secure enough to store your users passwords in an apparently retrievable form?

(I quite like Mozilla.org's guideline of storing the hashes in he database and the salts in the filesystem, to help ameliorate the consequences of an SQL injection attack...)