>...if they send you your password back in the clear in a password reminder email, rather than forcing you to create a new one.
This only indicates they store the password in a recoverable format. It could be encrypted. It shouldn't be stored encrypted -- hashing is the way to go -- but it doesn't mean the server has "hunter2" sitting on disk somewhere.
It is extremely annoying to make "recoverable" encryption schemes even nominally secure. Most of the time, anything that can mail your password might as well be storing the raw passwords. It's bad mojo to suggest that "reversable encryption" is a good strategy.
Every time this comes up, someone suggests some rube goldberg contraption involving multiple hosts and escrowed keys which is hard to refute except that it never exists in the real world and, even if it did, would still only provide security that asymptotically approaches hashing.
This only indicates they store the password in a recoverable format. It could be encrypted. It shouldn't be stored encrypted -- hashing is the way to go -- but it doesn't mean the server has "hunter2" sitting on disk somewhere.