One core financial system I'm familiar with obscured the home banking passwords by storing them in EBCDIC. It's trivial to recover them as long as you know the

One core financial system I'm familiar with obscured the home banking passwords by storing them in EBCDIC. It's trivial to recover them as long as you know the encoding. It had similar restrictions, including length. The same system does in-flight encryption (client communication to server) using a trivial byte-based XOR cypher, with the offset communicated in the clear when the connection is established. There are big problems out there.