[TigerC10]

Those mods aren't handing them out, vBulletin is. That's how users stay logged in without appending session IDs to the end of every URL. Session IDs hurt your google page rank big time...

The bbpassword cookie is formatted like so...

PHP Code:

MD5( MD5( MD5(plaintext_password) . user_salt ) . vB_license_number ) 


Essentially, the password hash stored in the cookie, is randomized with the user salt AND your vBulletin license number. MD5 is irreversable, so no one can get any of the private info of your users because your user salt is stored in the database (where only people with permission can get it) and the license number should only be visible by you.