Last week, I tried to register for a service and was really surprised by a password limit of 16 characters. Why on earth yould you impose such strict limits? Never heard of correct horse battery staple?
8 character max means they're running it on a mainframe I think, though I don't know enough about mainframes to know if this is a normal level of bad or really bad
Could be (probably still is) running COBOL. It's a combination of "if it works and costs money to upgrade, why change" but mostly "if we migrate one thing it will break five other things".