If you think that's bad, my water utility (Severn Trent Water), at the time, accepted a password of arbitrary length, but only processed 20 bytes of it at login

If you think that's bad, my water utility (Severn Trent Water), at the time, accepted a password of arbitrary length, but only processed 20 bytes of it at login time. This means when I created my account with a 63-character password, which it let me do, and then I logged in for the first time, literally minutes later, with the same 63-character password, it told me it was invalid. Of course, at the time, it didn't tell you what the length limit was, and the login and signup forms didn't limit it either. If I didn't have the bright idea (and prior experience elsewhere) to try "maybe it's only the first n characters of the password", starting at 8, and finally succeeding on 20 (thanks to no rate limiting), I would have never figured it out.