Kaspersky research shows that Safari, in saving a session for reopening later, stores session information in plain text. This includes usernames and passwords.