Microsoft definitely need to take the burn on this one.

You don't even need to look at the code to find out the passwords are stored in plain text. A quick tour through the database during testing would tell you everything you need to know here.

This is nothing more than laziness and ignorance.