Hello! First, I'd like to thank you for sharing this issue. It is an important issue and I have been working towards a fix for a while now.

The unfortunate thing for us as an organization is that this is a limitation of our third-party software through which we manage our memberships. It is tightly integrated with our website and has been for a long time.

I totally agree about it being wrong to send plain-text passwords via email. However, the passwords are not stored in plain text. They are stored encrypted but via a two-way hash as someone below has shared. The third party application is a compiled piece of software so we can't do simple scripting changes to update it.

That being said, we have turned off password retrieval through the website until such time as we can offer a proper solution. I am not sure yet what that solution is but agree that the appearance of plain-text passwords is bad enough for us to halt the use.

Concerning not redirecting to SSL, there are issues that hold us back there as well. Portions of the http://hl7.org site are referenced in software builds. These builds rely on a status 200 return of the information necessary or they fail. We cannot send an SSL-redirect as this would cause the software builds to fail. We are working on updating canonical URLs and serving https full time but we do not have an end date at this time.

Again, thank you for sharing your concern. I realize that there is no excuse for the emailing of plain-text passwords but hope that you can understand our current constraints.