No passwords stored at all - I've hacked my Kohana install for the stake of convenience, and all stored passwords are the MD5 of the user's facebook id, i.e. basically meaningless.