In reply to mark k..

If they have brute forced the salted and hashed passwords in order to expose short or common passwords, then I think they're being security conscious. I'm not sure its right to crack your customers own passwords, but if they're doing it to improve security in the context of increasing bad login attempts, then ok.

But the way in which this has been carried out does not give me confidence that they have security best practice in mind. If they couldn't send password reset emails then blanking all passwords would have been better. My password was perfectly secure until a new, shorter one was emailed to me in plaintext.