had a good laugh when i saw this article. thx mithrandir :)

passwords stored in the clear in server-side sessions => server hack compromises data. storing keys server-side means admins can get into your data.

had a big lol at the use of blowfish ECB - use of any cipher's ECB mode for bulk encryption is asking for problems. they should be using CBC, CTR, LRW or, ideally, XTS modes.