[ollifi]

I sort of wish companies would not have employees passwords. Hashing should be standard practice.

[ovi256]

It must be, but publishing old passwords can still be done by saving the old cleartext password on password change.

[BeFlatXIII]

As in store "old password" as cleartext on its final use?

[dotancohen]

The last password, to be posted, could be stored in plain text on the password change form submit action. Before that it is only ever committed to permanent storage as a hash.