#1 - ALWAYS encrypt passwords, no exceptions. Implementing SHA1 salted hashes is trivial.

#2 - Dates should be stored in UTC (make sure the server has the timezone correctly set), and display in the user's TZ or a reasonable default. The language will worry about DST. Don't let SQL touch it (in fact, you should probably store a UNIX timestamp - uint - instead of a datetime).

I would argue the above as "best practice" for storing that info. The douchebag is the developer who won't spend 5 minutes implementing either solution.