WebGUI currently stores passwords as a simple MD5 hash.  This is certainly better than storing the passwords in cleartext, but if access to the WebGUI database is compromised, it would be relatively easy for an attacker to recover the cleartext of the passwords via a precomputed hash dictionary (a rainbow table).

This sort of attack can me made impractical by using stronger hashing methods of the type described here.  Essentially, random salt is added to the password and stored alongside the hash, and adaptive hashing is used to make a brute force attack more expensive.

A scheme like this could be used to hash passwords.  For backwards compatibility, we could use plain MD5 hashing for accounts with no stored salt, and put all new passwords through the new algorithm.