That’s undoubtedly true, but brut force password cracking is something that banks have a relatively easy time of detecting and defeating, so one could argue tha

That’s undoubtedly true, but brut force password cracking is something that banks have a relatively easy time of detecting and defeating, so one could argue that the length/char limitations are not as big a problem. I’m far more concerned that many banks (at least in the US) still only offer SMS as a second factor, or even worse, use those horrible “security questions” and call that two-factor authentication.