The reason for this is that they use the same password in the call centre. So when you phone up they say "give us the 3rd letter of your password" and the 2nd digit of your Pin Number. The point of it is to make it hard for a call centre operator to get hold of your password. The internet banks are all built on top of the Direct Bank systems and ported that model in whole or in part to the internet. Legacy systems issue!

You could use Wells Fargo instead - they limit you to 14 characters, which isn't even what I would consider a medium length password.

I'm guessing that he's talking about Barclays in the UK. There the only one's i know who do this.

The Royal Bank of Scotland does this too, though they don't enforce crazy long passwords.

Lloyds TSB in the UK, too.

HSBC do this, but limit you to 10 digits