> Also accounts for money if they offer this kind of security This is something that astonishes me. So many financial institutions still have: - (low) max len

> Also accounts for money if they offer this kind of security This is something that astonishes me. So many financial institutions still have: - (low) max length limits on passwords - restrictions like no special chars in passwords, or exactly this many numbers etc - over reliance on a pin where a password would be more suitable - no 2fa, or at best SMS based 2fa - ridiculous security questions as if someone's favourite colour etc is drawn from a large pool of values As a developer I can guess that most of these restrictions are probably stemmed from a mountain of tech debt, but I would've expected this to be a priority for such companies. It makes me wonder if they are bound to follow some outdated regulations or something preventing them from doing better