I recently signed up for a company's product, and promptly received an email confirming my registration, showing both my email address and my password. I'm not a security expert, but that was a huge red flag for me. Performed some google searches, I see nothing good about sending passwords as clear text. This includes a previous security.stackexchange.com post asking a similar question, however, it was asked quite a few years ago, so I don't know if something has changed with security.
I was about to send them an email nearly scolding them and asking for an explanation as to why they are emailing passwords, but remembered seeing that emails are TLS encrypted. So I double checked the email in gmail, and sure enough, it is TLS encrypted.
Reading into Tesco's hack, I'm understanding that there is still a problem with the fact that the company knows what the password is to begin with. Based on what I'm reading, passwords should be salted AND hashed, and the company should never know what the password is.
Before I send this email, am I right? Is there a point in time where a company will know the password, securely send the password to an email address, and salt/hash the password, being none the wiser? Or do they deserve this email I'm about to send?