yeah that's really bad. there are solid password handling libraries for pretty much every popular language out there by now. many of them aren't perfect by any means, but anything is better than doing absolutely nothing. i wouldn't trust that vendor either.