Am I the only who is crazy surprised this still happens? New startups have absolutely no excuse since every framework/language has some helpers for users and passwords. Old companies have no excuse because its trivially easy to upgrade users passwords to the new encrypted format.