I wish I could have ignored you saying that John Carmack is not a real hacker, but I couldn't.

Carmack has consistently pushed forward multiple industries on multiple fronts, and remains to this day a far better programmer than any I've ever worked with. He revolutionized computer gaming while living the life just because he loves it. He's not famous because he has Ferraris; his Ferraris are famous because they're his.

He doesn't need anyone to set him up with an annuity--maybe because his love was more mainstream than theirs, or maybe because his skill was far greater than theirs--but that in no way diminishes what he has accomplished or his motivations for accomplishing it.

Cleartext passwords are perfectly fine in this case. I speak as a software engineer specialized in security.

This bug report was filed by someone who doesn't understand that obfuscating a password is different from encrypting it. No matter how you store it, the application must be able to extract a cleartext password from whatever storage options are available on the Android device.

For a longer explanation: http://developer.pidgin.im/wiki/PlainTextPasswords

That said, one defense-in-depth mechanism that I would like to see on portable devices like phones would be to have an encrypted storage area that is only accessible after typing a passphrase at boot time (the key derived from this passphrase should be stored in volatile memory only). That way if the device is shut down, this secure area would not be decryptable.

Edit: I am defending the mail application because from its viewpoint it is fine to use cleartext passwords. On the other hand the OS should provide a secure storage area as described in my previous paragraph.