They email your password to you when you use the "forgot" form.
I notified support about this and the representative said he agrees that it's a security flaw and that he had "sent it up the chain", although this was last year.
Despite this, they're still my preferred registrar.
