My favorite: the flying toasters :)

At work, in our own developed CRM software, passwords are only xored with a const and stored in database. A few weeks ago i was bored at work. I wrote an SQL function which dumps all user passwords. 123456 is still alive ;-)