Pandora doesn't hash their passwords
My jaw dropped. How does such a publicly visible website think it is okay to show users their password without them asking?<p>It should now be assumed that every hacker on the planet knows about this vulnerability, and Pandora will see attacks against their database very soon. What we don't know is if Pandora is <i>storing</i> users' passwords in plaintext. It is possible that Pandora remembers your password server-side for your session. I hope that this is the case. If it turns out to be anything else--plaintext passwords in database, etc.--then Pandora is worse than LinkedIn.