Writing new software is easy. Maintaining large, existing codebases for mission-critical software is hard. Banks were early adopters; there's fifty year old code that does some things extremely well, but also sometimes results in user-facing quirks like oddly limited password fields.
Good point. Assuming that the offending code is the actual password storage rather than an intermediary subsystem, one can safely make the assumption that such password storage is insecure. Which isn't much of a revelation, considering the article.
