Passwords are stored in the plain text config file. This is very insecure and should be avoided if at all possible.
This note is already answered. See the comment for bug which this bug is duplicate of. *** This bug has been marked as a duplicate of bug 3516 ***