Ironically, immediately after reading these guidelines, I checked my email and had just received an email from Mozilla's mailing list service that contained my password in plaintext. Oops. (To be fair, it looks like they're just using Mailman http://www.list.org/)