I'm sure I'm preaching to the choir, but wow - not using one way hashes is an absolutely terrible security hole.