And you appear to have received an answer there, as well. Anything using OAuth doesn't need to store passwords, and for anything else ifttt stores the password in an encrypted (but obviously retrievable) form. I don't see how they could do otherwise; at most, they could refuse to interoperate with any sites not supporting OAuth, and I don't see the benefit to that.