> Why do so many companies use public information for security questions? Why do so many companies store passwords in plain text, have an 8 character password

> Why do so many companies use public information for security questions? Why do so many companies store passwords in plain text, have an 8 character password limit and/or don't bother patching their machines?