Really worrying is when you run into something like a major Canadian bank where the online banking portal system rejects passwords longer than 14 characters and with a wide range of standard english punctuation marks in it, likely because they're storing the damned thing as a plaintext string in some mainframe database field on equipment/software from the 1980s.

It was like that up until very recently for some gargantuan banks.