Where are SQL 2008 Login passwords stored?
The passwords aren't stored in plaintext. If the auditor really needs the file in which they're stored, point them at the master.mdf file. This is, of course, for SQL logins. For Windows logins, SQL doesn't even know what the password is; Active Directory handles the authentication.
Try to look into sys.server_principals user names and passwords are in the master database.
But the passwords are not stored in plaintext.